A path traversal flaw exists in the file handling logic of PV-Bhat gemsuite-mcp 1.0.0, specifically in the argument processing for file_path/file_paths within src/handlers/unified-gemini.ts. Based on the description that manipulation of file_path arguments results in path traversal, it is inferred that a local attacker could read or potentially write arbitrary files. The attack must be initiated from a local position, as noted in the description. The weakness corresponds to CWE-22 and is limited to local execution; no remote exploitation is currently supported.

The affected vendor and product is PV-Bhat gemsuite-mcp, version 1.0.0. No additional version ranges are specified, so it is assumed that this single release contains the flaw.

The CVSS score of 4.8 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, implying limited evidence of widespread exploitation. The attack vector is local, requiring the attacker to execute code within the application context or otherwise trigger the vulnerable handler. Given the absence of publicly known exploitation and the requirement for local access, the overall risk is moderate but warrants assessment for environments where local code execution could lead to privilege escalation or data exposure.