Executive brief
The Model Context Protocol Filesystem server is used to provide file system access capabilities to AI models and applications. A vulnerability in its path validation logic allows attackers to bypass directory restrictions and access unintended files on the system via symbolic links, potentially exposing sensitive data or enabling unauthorized file operations.
Technical details
This vulnerability (CWE-59: Improper Link Resolution) exists in versions prior to 0.6.3 and 2025.7.1 of @modelcontextprotocol/server-filesystem. The root cause is improper path validation that fails to correctly handle symlinks within allowed directories; an attacker can exploit prefix-matching flaws and symlink handling to traverse beyond the intended directory boundaries. The vulnerability requires local access with low privileges, and an attacker can achieve unauthorized file access within subsequent systems, potentially compromising confidentiality, integrity, and availability. Patches are available in versions 0.6.3 and 2025.7.1.
Affected products
- Anthropic @modelcontextprotocol/server-filesystem before 0.6.3 and before 2025.7.1
Timeline
- 2025-07-01: disclosed: GHSA-q66q-fx2p-7w4m published
- 2025-07-01: patched: Versions 0.6.3 and 2025.7.1 contain fixes