highATLS-2025-0004CVE-2025-53110

MCP filesystem server: path prefix collision bypasses the allowed-directory check

Imported from public sources listed below. Verfy has not independently reproduced this issue.

Details

In @modelcontextprotocol/server-filesystem before 0.6.4 (or 2025.7.01), the allowed-directory check compared path prefixes as strings, so a path such as /data/allowed_evil passed a check for /data/allowed. This let callers reach files outside the configured directories. Upgrade to 0.6.4 / 2025.7.01 or later.

Affected

npm @modelcontextprotocol/server-filesystem

Versions before 0.6.4. Fixed in 0.6.4.

# check what a project uses
$ npm ls @modelcontextprotocol/server-filesystem

References

https://nvd.nist.gov/vuln/detail/CVE-2025-53110 (ADVISORY)
https://v2.cvefeed.io/vuln/detail/CVE-2025-53110 (WEB)

Published in Verfy 2026-10-11 · modified 2026-10-11