The vulnerability lies in the Handwriting-OCR handwriting-ocr-mcp-server 0.1.0 package, where the fs.readFileSync call in src/index.ts fails to sanitize the file argument. A local attacker can supply a crafted path such as ../../../../etc/passwd to read any file the service process can access. This results in disclosure of sensitive data but does not grant code execution. The weakness is classified as CWE-22.

The flaw affects the Handwriting-OCR handwriting-ocr-mcp-server component version 0.1.0, an open-source OCR backend hosted on GitHub. Only systems running this specific version and exposing the upload_document functionality are vulnerable.

With a CVSS score of 4.8, the risk is moderate, and exploitation requires local access to the service. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker would manually invoke the upload_document endpoint with a manipulated file path; if allowed, the service will return the contents of any file it can read, presenting an opportunity for internal data exposure.