A path‑traversal flaw exists in the get_best_practices endpoint of the ggerve coding‑standards‑mcp server. By manipulating the Language argument, an attacker can traverse directories and read arbitrary files on the host. The vulnerability can be exercised remotely via a crafted HTTP request, potentially exposing sensitive configuration or source code and compromising confidentiality of the system.

The vulnerable component is the ggerve coding‑standards‑mcp application. Because the project deploys rolling releases, no specific affected version numbers are available, and the vendor has not yet published a fixed release.

The CVSS score of 6.9 indicates a moderate to high severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed from any network location that can reach the vulnerable endpoint, and the exploit has already been made public. Given the lack of an immediate fix and the remote nature of the attack, the overall risk is significant until an official patch is deployed or mitigated.