Executive brief
fast-filesystem-mcp is a file system access library used by AI model context protocol servers to read and manipulate files. The library contains a path traversal vulnerability that allows attackers to bypass directory access restrictions by creating symbolic links pointing to restricted system paths. An attacker can exploit this to read unauthorized files outside the intended access scope, potentially exposing sensitive system data or application secrets.
Technical details
The vulnerability is a path traversal flaw (CWE-24) in fast-filesystem-mcp's path validation logic. The safePath and isPathAllowed functions in utils.ts use path.resolve() to validate paths, but this function does not resolve symbolic links to their actual target locations. An attacker can create symlinks within an allowed directory that point to restricted paths (e.g., /home/allowed/link -> /etc/passwd), and when these symlinks are accessed via the fast_read_file tool, the validation checks pass because the symlink path itself is within the allowed directory. The actual symlink target is then followed during file operations, allowing access to unauthorized files. No authentication is required and the attack is network-accessible. The fix requires using fs.realpath() or equivalent to resolve symlinks during validation.
Affected products
- efforthye fast-filesystem-mcp up to 3.4.0
Timeline
- 2026-01-07: disclosed: Published on GHSA and NVD
- 2026-01-07: advisory