Bioinfomcp
Monthly
Path traversal in BioinfoMCP's Upload Endpoint allows remote unauthenticated attackers to read or write files outside the intended directory by manipulating the Name argument in the Upload function (bioinfo_mcp_platform/app.py). The affected product is florensiawidjaja's BioinfoMCP at or before commit 7ada7918b9e515604d3c0ae264d3a9af10bf6e54, a bioinformatics platform using continuous rolling releases. A public exploit exists via GitHub issue report, and SSVC classifies the attack as automatable with partial technical impact; however, EPSS remains very low at 0.05% (14th percentile), consistent with an obscure research tool rather than widespread enterprise software. No vendor patch or response has been issued as of the time of this analysis.
Path traversal in BioinfoMCP's Upload Endpoint allows remote unauthenticated attackers to read or write files outside the intended directory by manipulating the Name argument in the Upload function (bioinfo_mcp_platform/app.py). The affected product is florensiawidjaja's BioinfoMCP at or before commit 7ada7918b9e515604d3c0ae264d3a9af10bf6e54, a bioinformatics platform using continuous rolling releases. A public exploit exists via GitHub issue report, and SSVC classifies the attack as automatable with partial technical impact; however, EPSS remains very low at 0.05% (14th percentile), consistent with an obscure research tool rather than widespread enterprise software. No vendor patch or response has been issued as of the time of this analysis.