Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch).

MediumGHSA-7rgq-gccq-qphx25 Oct · today
Source

Does it affect you?

0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

25 Oct
35 minfrom publication to Patchwire
  1. Published by GitHub advisory25 Oct, 00:18 UTC
  2. Seen by Patchwire +35 min25 Oct, 00:53 UTC
@modelcontextprotocol/server-filesystem2.0.1

Versions of @modelcontextprotocol/server-filesystem

2.x
safe 2.0.1
AffectedSafe

Packages

@modelcontextprotocol/server-filesystem

Stacks

Not part of a tracked stack.

Related alerts(3)

Same packages

@modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project runs @modelcontextprotocol/server-filesystem on a vulnerable version (e.g. 2026.1.14 or another date-versioned release; fixed in 2.0.1).
  • The server is configured with an allowed directory.
  • A symlink exists inside the allowed directory pointing to a file outside the allowed directory.
  • An attacker can influence the list_directory_with_sizes tool call, directly or via prompt injection or repository content read by an agent.
Affected
@modelcontextprotocol/server-filesystem >=2025.7.1 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-hhwq-wxfx-cj7g
Open the alert

Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project uses @modelcontextprotocol/server-filesystem (versions including the 2025.7.1 fixes, where validatePath returns the un-canonicalised path on the ENOENT fallback).
  • The server exposes write_file, edit_file, create_directory, or move_file tool calls that create a not-yet-existing path inside an allowed directory.
  • A separate local process running as the same user can replace a parent directory inside allowedDirectories with a symlink pointing outside the allowed tree during the race window.
Affected
@modelcontextprotocol/server-filesystem >=2025.1.14 <=2026.8.31 · @modelcontextprotocol/server-filesystem <2.0.1
Fixed in
2.0.1
ID
GHSA-53mr-w429-c597
Open the alert

Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/server-filesystem version 2026.8.31, 1.0.0 or 2.0.0.
  • The allowed directories reside on a case-insensitive file system (e.g. macOS APFS or Windows NTFS defaults, or a case-folded mount).
  • An allowed directory contains a symlink that points outside the allowed directories.
  • A client can call create directory, write file, or move file (destination) with a path that spells a component with different letter case.
Affected
@modelcontextprotocol/server-filesystem 2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-4gxg-m5jx-9j57
Open the alert