@modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata.

LowGHSA-hhwq-wxfx-cj7g25 Oct · today
Source

Does it affect you?

0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

25 Oct
34 minfrom publication to Patchwire
  1. Published by GitHub advisory25 Oct, 00:19 UTC
  2. Seen by Patchwire +34 min25 Oct, 00:53 UTC
@modelcontextprotocol/server-filesystem2.0.1

Versions of @modelcontextprotocol/server-filesystem

2.x
safe 2.0.1
AffectedSafe

Packages

@modelcontextprotocol/server-filesystem

Stacks

Not part of a tracked stack.

Related alerts(3)

Same packages

Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories

@modelcontextprotocol/server-filesystem · 25 Oct

Low
Exploitable only if · read by Claude, the source remains the reference
  • Project uses @modelcontextprotocol/server-filesystem (versions including the 2025.7.1 fixes, where validatePath returns the un-canonicalised path on the ENOENT fallback).
  • The server exposes write_file, edit_file, create_directory, or move_file tool calls that create a not-yet-existing path inside an allowed directory.
  • A separate local process running as the same user can replace a parent directory inside allowedDirectories with a symlink pointing outside the allowed tree during the race window.
Affected
@modelcontextprotocol/server-filesystem >=2025.1.14 <=2026.8.31 · @modelcontextprotocol/server-filesystem <2.0.1
Fixed in
2.0.1
ID
GHSA-53mr-w429-c597
Open the alert

Path traversal via trailing quote/whitespace in validatePath (Check/Use Mismatch)

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Project runs the @modelcontextprotocol/server-filesystem MCP server at a version before 2.0.1 (including date-versioned 2025.x/2026.x releases).
  • Server is configured with allowed directories intended to sandbox filesystem tool access.
  • An attacker can influence the path arguments of the server's filesystem tools (e.g. via prompt injection in content the LLM reads).
  • A sibling path exists (or can be created via the write tools) named like an allowed directory plus a trailing quote or whitespace character.
Affected
@modelcontextprotocol/server-filesystem >=2025.8.21 <=2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-7rgq-gccq-qphx
Open the alert

Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem

@modelcontextprotocol/server-filesystem · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Uses @modelcontextprotocol/server-filesystem version 2026.8.31, 1.0.0 or 2.0.0.
  • The allowed directories reside on a case-insensitive file system (e.g. macOS APFS or Windows NTFS defaults, or a case-folded mount).
  • An allowed directory contains a symlink that points outside the allowed directories.
  • A client can call create directory, write file, or move file (destination) with a path that spells a component with different letter case.
Affected
@modelcontextprotocol/server-filesystem 2026.8.31 · @modelcontextprotocol/server-filesystem >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-4gxg-m5jx-9j57
Open the alert