The Jimeng MCP application in version 1.10.0 includes a path traversal flaw in the getFileContent, uploadCoverFile, generateImage, and generateVideo functions defined in src/api.ts. The flaw arises because the filePath argument is manipulated without proper validation, permitting an attacker to reference directories outside the intended scope. This remote flaw can lead to reading of arbitrary files, and in some configurations may allow overwriting of files, resulting in information disclosure or integrity compromise.

The affected product is c‑rick's Jimeng MCP, version 1.10.0. Any installation running this exact version is vulnerable until a vendor‑issued fix is applied.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so the probability of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely, and because the flaw bypasses path restrictions, the risk can be significant if the application processes untrusted input.