The vulnerability resides in the get_pdf_path function of the PDF File Handler component. By manipulating the filepath argument, an attacker can traverse directories outside the intended PDF storage location, gaining read access to arbitrary files on the underlying system. The CVSS score of 6.9 reflects a moderate severity, but the exploit is publicly available and can be launched remotely, raising the risk of unauthorized data disclosure.

eiceblue spire-pdf-mcp-server version 0.1.1; any installation running this exact version is affected. No other versions are listed in the advisory.

The exploit can be targeted from an external network, using crafted requests to the server. Since the EPSS score is unavailable and the vulnerability is not catalogued in KEV, the likelihood is uncertain but the existence of a published exploit indicates that attackers may already be attempting the attack. The CWE-22 classification highlights that the root cause is improper handling of user-supplied paths.