The vulnerability in the 8nite metatrader‑4‑mcp component enables an attacker to manipulate the ea_name argument in CallToolRequestSchema, resulting in a path traversal condition that can be exploited remotely. By supplying a crafted value, an adversary can cause the system to resolve file paths outside the intended directory. This leads to reading or potentially executing files on the host, violating confidentiality and integrity of the system.

8nite metatrader‑4‑mcp version 1.0.0 is affected. The issue pertains to the sync_ea_from_file module found in src/index.ts. No other versions or products are listed as affected.

The CVSS score is 5.3, indicating moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known exploited vulnerability at this time. However, the exploitation can be performed remotely and the attacker may be able to read or access files outside the intended directory. With no official patch or response from the project, the likelihood remains uncertain but the risk persists for any system running the affected component.