A path traversal flaw exists in the notes_mcp.py component of the notes-mcp project, affecting versions up to 0.1.4. The vulnerability is triggered by manipulating the root_dir or path argument, which allows an attacker to reference file system locations outside the intended directory hierarchy. The flaw can be exploited remotely, resulting in unauthorized file access or disclosure of sensitive configuration data. The effect may compromise confidentiality and potentially allow broader system exploitation if critical files are read or altered.

The exploit targets the open-source notes-mcp application developed by Edvard Lindelof. All deployments using the notes-mcp package at or below version 0.1.4 are vulnerable. No additional vendor or product ranges are specified beyond the notes-mcp package itself.

The CVSS score of 6.9 classifies the vulnerability as moderate severity, with the attacker required to supply a malicious root_dir or path argument via a remote interface. The EPSS score is not provided, and the issue is not listed in the CISA KEV catalog, suggesting that while the flaw is documented, the exploitation rate may be low at present. Nonetheless, because the attacker can read arbitrary files, the risk to confidentiality is significant, especially in environments where notes-mcp is exposed to external users or network traffic.