CVE-2025-53109highBroken access control2025-07-01
CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve.
What it is
Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve.
How to check
- Affected: @modelcontextprotocol/server-filesystem (npm) <= 0.6.2.
- Affected: @modelcontextprotocol/server-filesystem (npm) >= 2025.1.14, < 2025.7.1.
- Compare your installed version with the range above (command below).
How to fix
- No patched version of @modelcontextprotocol/server-filesystem is listed yet. Follow the advisory for mitigations.
- Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.
npm ls @modelcontextprotocol/server-filesystemSources
More advisories for this tool
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
- criticalCVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connections
- criticalCVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxy
- highCVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server