A path traversal vulnerability exists in the Upload function of florensiawidjaja BioinfoMCP. By manipulating the Name argument supplied to the upload endpoint, an attacker can store files outside the intended upload directory, potentially overwriting critical configuration files or placing malicious scripts. Because the flaw is remote and the upload endpoint is publicly reachable, this capability can be exercised without prior authentication.

All installations of florensiawidjaja BioinfoMCP derived from the repository prior to the commit 7ada7918b9e515604d3c0ae264d3a9af10bf6e54 are impacted. The project uses continuous delivery, so the exact version string is not tracked; any deployment that has not been patched or updated to a build that includes the fix is vulnerable.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability has not been listed in CISA’s KEV catalog. Attackers can exploit this flaw remotely by sending a crafted HTTP request to the upload endpoint with a Name that contains directory traversal sequences. As no official patch has been released and exploitation is publicly documented, there is a risk that arbitrary files can be written to unintended locations, which may compromise the integrity of the system.