high
ATLS-2025-0003CVE-2025-53109MCP filesystem server: symlinks inside an allowed directory escape the allowed-directory boundary
Imported from public sources listed below. Verfy has not independently reproduced this issue.
Details
In @modelcontextprotocol/server-filesystem before 0.6.4 (or 2025.7.01 in the date-based versioning), flawed error handling around symlink resolution let a symlink placed inside an allowed directory point to files outside it, bypassing the server's directory containment. An agent or prompt that can create files could use this to read or write files the server was not meant to expose. Upgrade to 0.6.4 / 2025.7.01 or later.
Affected
npm
@modelcontextprotocol/server-filesystemVersions before 0.6.4. Fixed in 0.6.4.
# check what a project uses
$ npm ls @modelcontextprotocol/server-filesystemReferences
- https://nvd.nist.gov/vuln/detail/CVE-2025-53109 (ADVISORY)
- https://advisories.gitlab.com/pkg/npm/@modelcontextprotocol/server-filesystem/CVE-2025-53109/ (ADVISORY)
Published in Verfy 2026-10-11 · modified 2026-10-11