Executive brief
claude-faf-mcp is a persistent project context tool for Claude that provides file manipulation capabilities. The vulnerability allows an attacker to read and write arbitrary files on the server's filesystem (such as SSH keys, cloud credentials, or environment files) by exploiting an unvalidated path argument, bypassing the intended project directory restrictions. An attacker could inject a malicious prompt into Claude via untrusted content to trigger this file access.
Technical details
The vulnerability is a path traversal / external control of file name (CWE-22, CWE-73) flaw in the faf_read, faf_write, and getProjectPath() functions. These tools accept caller-controlled path arguments and resolve them using tilde expansion and path.resolve() without confining the result to the intended .faf project directory. Absolute paths and ../ traversals bypass all restrictions, allowing read/write access to any file the server process can access (limited only by OS file permissions). The attack is triggered via a crafted MCP tool call—either from a malicious MCP client or from an LLM that has been prompt-injected with attacker-controlled content (e.g., from a web page, README, GitHub ticket, or .faf file). The fix, available in version 5.7.2, canonicalizes all paths through symlinks, rejects absolute paths and ../ escapes, and confines reads to .faf/.fafm context files and general file ops to the project root (with FAF_ALLOWED_ROOTS override).
Affected products
- Wolfe-Jam claude-faf-mcp <= 5.7.1
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 5.7.2