Executive brief
claude-faf-mcp is a Model Context Protocol server providing file and project management tools for the Claude AI assistant. The server fails to validate file paths before filesystem operations, allowing an attacker to read any file accessible to the server process—including SSH keys, AWS credentials, and environment secrets stored in the home directory. An attacker can inject malicious tool calls via prompt injection on attacker-controlled content (web pages, README files, or tickets) to exfiltrate sensitive data. In affected versions, the vulnerability also permits writing files outside the intended project directory.
Technical details
The vulnerability is a path-traversal / improper path confinement issue (CWE-22, CWE-73, CWE-200) in the `getProjectPath()` function and general-purpose `faf_read`/`faf_write` file tools. The code resolves caller-supplied paths using home-directory expansion (~) and `path.resolve()` without confining the result to a trusted project directory; absolute paths and `../` sequences are accepted and used directly in filesystem read/write operations. An MCP client (or an LLM receiving attacker-controlled content) can issue a crafted tool call with a path like `/etc/passwd` or `~/.ssh/id_rsa` to read arbitrary files, or with `faf_write` to write outside the project. The only remaining restriction is OS-level file permissions; no application-level path boundary is enforced. Fixed in version 5.7.2 by implementing path canonicalization, symlink resolution, and a whitelist-based confinement model that restricts reads to `.faf`/`.fafm` context and general file ops to the project root.
Affected products
- Wolfe-Jam claude-faf-mcp <= 5.7.1
Timeline
- 2026-06-11: disclosed: Vulnerability identified by maintainers and fixed in v5.7.2
- 2026-06-11: patched: Patch released in v5.7.2 with path confinement enforcement
- 2026-08-19: advisory: Published to GitHub Advisory Database