mcp-go-divi-translation

The server has a critical path traversal vulnerability. The 'inputPath' and 'outputPath' parameters for file-based operations (e.g., 'extract_divi_text', 'start_divi_translation') are taken directly from user input and used without sufficient sanitization or restriction to a designated directory. This could allow an attacker to read from or write to arbitrary file system locations outside the intended working directory. WordPress MySQL credentials are handled via environment variables, which is standard practice, but requires users to securely manage their '.env' file or environment configuration.