Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories.

LowGHSA-53mr-w429-c59725 Oct · today
Source

Does it affect you?

0/3All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

25 Oct
34 minfrom publication to Patchwire
  1. Published by GitHub advisory25 Oct, 00:19 UTC
  2. Seen by Patchwire +34 min25 Oct, 00:53 UTC
@modelcontextprotocol/server-filesystem2.0.1

Versions of @modelcontextprotocol/server-filesystem

2.x
safe 2.0.1
AffectedSafe

Packages

@modelcontextprotocol/server-filesystem

Stacks

Not part of a tracked stack.

Related alerts(3)

Same packages

@modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project runs @modelcontextprotocol/server-filesystem on a vulnerable version (e.g. 2026.1.14 or another date-versioned release; fixed in 2.0.1).
  • The server is configured with an allowed directory.
  • A symlink exists inside the allowed directory pointing to a file outside the allowed directory.
  • An attacker can influence the list_directory_with_sizes tool call, directly or via prompt injection or repository content read by an agent.
Affected
@modelcontextprotocol/server-filesystem >=2025.7.1 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-hhwq-wxfx-cj7g
Open the alert

Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Project runs the @modelcontextprotocol/server-filesystem MCP server at a version before 2.0.1 (including date-versioned 2025.x/2026.x releases).
  • Server is configured with allowed directories intended to sandbox filesystem tool access.
  • An attacker can influence the path arguments of the server's filesystem tools (e.g. via prompt injection in content the LLM reads).
  • A sibling path exists (or can be created via the write tools) named like an allowed directory plus a trailing quote or whitespace character.
Affected
@modelcontextprotocol/server-filesystem >=2025.8.21 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-7rgq-gccq-qphx
Open the alert

Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/server-filesystem version 2026.8.31, 1.0.0 or 2.0.0.
  • The allowed directories reside on a case-insensitive file system (e.g. macOS APFS or Windows NTFS defaults, or a case-folded mount).
  • An allowed directory contains a symlink that points outside the allowed directories.
  • A client can call create directory, write file, or move file (destination) with a path that spells a component with different letter case.
Affected
@modelcontextprotocol/server-filesystem 2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-4gxg-m5jx-9j57
Open the alert