This lack of path confinement enables path traversal attacks, where an attacker can supply sequences such as ../../ to escape the intended directory. Because the application processes these inputs with the privileges of the server user, an attacker can overwrite critical system files, including ~/.ssh/authorized_keys or application binaries, facilitating privilege escalation or remote code execution. This affects consciousness-explorer prior to 1.1.2, sublinear-time-solver prior to 1.6.0, and the sublinear crate prior to 0.2.0.

Impact

Successful exploitation results in arbitrary file write capabilities, compromising the integrity of the server host. This poses a significant risk if the MCP server is exposed to untrusted clients, as an attacker could gain control over the host environment by overwriting configuration files or injecting malicious scripts into execution paths.

Recommendation

• Upgrade consciousness-explorer to 1.1.2 or later, sublinear-time-solver to 1.6.0 or later, and sublinear to 0.2.0 or later to apply the path-confinement and basename-only contract fixes.
• Implement the recommended environment variables CONSCIOUSNESS_EXPLORER_STATE_DIR and SUBLINEAR_SOLVER_VECTOR_DIR to enforce state file storage in dedicated, non-sensitive directories.
• Apply the principle of least privilege by running the MCP server under a dedicated, restricted-privilege user account.
• Audit logs for the export_state and import_state MCP tool calls to identify attempts to supply non-basename paths or path traversal sequences.