The vulnerability resides in the image_to_3d_async function of the Flux159 mcp-game-asset-gen 0.1.0 component. By manipulating the statusFile argument, an attacker can traverse directories to read files outside the intended directory structure. This path traversal allows the attacker to gain access to arbitrary files on the filesystem, potentially exposing sensitive data or enabling further exploitation if executable files can be accessed or written.

Flux159 mcp-game-asset-gen, version 0.1.0.

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available and can be carried out remotely, meaning that any system exposing the image_to_3d_async endpoint to untrusted users is at risk. Existing attack vectors rely on remote input to the statusFile parameter; no additional prerequisites are identified in the provided data.