Description
An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver. The MCP export_state (and import_state) tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync / fs.readFileSync without constraining the destination or rejecting path traversal.
Recommendation
Update the consciousness-explorer package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.1.2
- Patched version(s): 1.1.2
References
Could your website be exposed too?
SmartScanner can check your website for consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + M - CVE-2026-86439
- Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- @appium/support has a Zip Slip arbitrary file write in its ZIP extraction - CVE-2026-30973
You might also like:
See something that needs correcting? Let us knowUpdated August 25, 2026