The flaw resides in the search_papers function of src/main.py. By manipulating the query parameter topic, an attacker can craft a request that causes the application to construct a filesystem path containing directory traversal sequences such as ../. This allows the server to access files outside its intended directory, potentially revealing sensitive data. The vulnerability can be triggered remotely and the exploit code is publicly available.

The affected product is duartium's papers‑mcp‑server, specifically the version identified by commit 9ceb3812a6458ba7922ca24a7406f8807bc55598. No other vendors or product variants are listed in the CNA data.

The CVSS score of 6.9 indicates a medium severity risk. Because the EPSS score is not provided, the exact likelihood of exploitation is unclear, but the vulnerability is listed as not in the CISA KEV catalog. The public availability of an exploit and the ability to conduct the attack remotely increase the practical risk. An adversary could read arbitrary files on the host, which may contain configuration settings, secrets, or user data.