The delete_shared_prompt function in mcpo_simple_server allows an attacker to manipulate a detail argument, enabling relative path traversal that can result in arbitrary file access or deletion. This flaw can lead to data loss or the exposure of sensitive information. The weakness belongs to CWE-22 and CWE-23, which describe directory traversal vulnerabilities.

getsimpletool mcpo-simple-server versions up to and including 0.2.0 are affected. Users running any 0.2.0 or earlier release are at risk until a fix is applied.

The CVSS score of 6.9 indicates moderate severity, and the exploit is publicly available, allowing remote attackers to exercise this path traversal. EPSS data is not available, and it is not listed in CISA KEV, but the remote nature of the attack and the potential to delete or read arbitrary files means a real threat exists. Attackers would target the delete_shared_prompt endpoint over the network to craft malicious input that forces traversal.