Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem.

MediumGHSA-4gxg-m5jx-9j5725 Oct · today
Source

Does it affect you?

0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

25 Oct
35 minfrom publication to Patchwire
  1. Published by GitHub advisory25 Oct, 00:18 UTC
  2. Seen by Patchwire +35 min25 Oct, 00:53 UTC
@modelcontextprotocol/server-filesystem2.0.1

Versions of @modelcontextprotocol/server-filesystem

2.x
safe 2.0.1
AffectedSafe

Packages

@modelcontextprotocol/server-filesystem

Stacks

Not part of a tracked stack.

Related alerts(3)

Same packages

@modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project runs @modelcontextprotocol/server-filesystem on a vulnerable version (e.g. 2026.1.14 or another date-versioned release; fixed in 2.0.1).
  • The server is configured with an allowed directory.
  • A symlink exists inside the allowed directory pointing to a file outside the allowed directory.
  • An attacker can influence the list_directory_with_sizes tool call, directly or via prompt injection or repository content read by an agent.
Affected
@modelcontextprotocol/server-filesystem >=2025.7.1 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-hhwq-wxfx-cj7g
Open the alert

Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project uses @modelcontextprotocol/server-filesystem (versions including the 2025.7.1 fixes, where validatePath returns the un-canonicalised path on the ENOENT fallback).
  • The server exposes write_file, edit_file, create_directory, or move_file tool calls that create a not-yet-existing path inside an allowed directory.
  • A separate local process running as the same user can replace a parent directory inside allowedDirectories with a symlink pointing outside the allowed tree during the race window.
Affected
@modelcontextprotocol/server-filesystem >=2025.1.14 <=2026.8.31 · @modelcontextprotocol/server-filesystem <2.0.1
Fixed in
2.0.1
ID
GHSA-53mr-w429-c597
Open the alert

Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Project runs the @modelcontextprotocol/server-filesystem MCP server at a version before 2.0.1 (including date-versioned 2025.x/2026.x releases).
  • Server is configured with allowed directories intended to sandbox filesystem tool access.
  • An attacker can influence the path arguments of the server's filesystem tools (e.g. via prompt injection in content the LLM reads).
  • A sibling path exists (or can be created via the write tools) named like an allowed directory plus a trailing quote or whitespace character.
Affected
@modelcontextprotocol/server-filesystem >=2025.8.21 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-7rgq-gccq-qphx
Open the alert