Executive brief
The Filesystem server component in the Model Context Protocol allows remote attackers to access files outside intended directories through a path validation flaw. When a configured directory path shares a matching prefix with another path on the system, an attacker can bypass access controls and read or modify sensitive files. This could expose confidential data or allow unauthorized system modifications.
Technical details
A path traversal vulnerability (CWE-22) exists in @modelcontextprotocol/server-filesystem versions prior to 0.6.3 and 2025.7.1, caused by insufficient validation of directory prefix matching. The vulnerability occurs when allowed directories share common path prefixes with unintended locations; an attacker can craft requests that match the prefix validation logic but access files outside the intended scope. The attack requires no authentication and can be exploited over the network via passive user interaction. Successful exploitation allows confidentiality, integrity, and availability impacts on subsequent systems that rely on the filesystem server. Patches are available in versions 0.6.3 and 2025.7.1 or later.
Affected products
- Anthropic @modelcontextprotocol/server-filesystem versions prior to 0.6.3 and prior to 2025.7.1
Timeline
- 2025-07-01: disclosed: Vulnerability advisory published
- 2025-07-01: patched: Versions 0.6.3 and 2025.7.1 released