The flaw resides in the get_doc_path function of eiceblue spire-doc-mcp-server version 1.0.0 and allows an attacker to manipulate the document_name argument to perform a path traversal. This vulnerability is categorized as CWE‑22 and can be triggered remotely, potentially enabling the attacker to read or disclose sensitive files on the file system where the server is running. The impact is primarily a breach of confidentiality, and the attacker may gain access to arbitrary files within the server’s directory structure.

The affected product is eiceblue spire-doc-mcp-server, currently at release 1.0.0. No other versions or products are listed as impacted.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is not available. The vulnerability has not been listed in CISA’s KEV catalog. Attackers can remotely trigger the traversal by supplying a crafted document_name value. Since the server processes the input without sanitization, the path traversal path can be constructed to reference files outside the intended directory. The lack of input validation and limited access controls make exploitation likely if the attacker can reach the service.