Executive brief
filesystem-mcp is an MCP server that provides file reading functionality for AI assistants and automation tools. A path traversal vulnerability in version 0.5.8 allows attackers to read files outside the intended directory by exploiting symlinks, potentially exposing sensitive system files or application secrets to unauthorized access.
Technical details
The vulnerability is a path traversal flaw in the "read_content" tool caused by improper symlink handling. The resolvePath function validates paths before symlink resolution, but fs.readFile resolves symlinks during actual file access, allowing attackers to bypass directory restrictions by crafting symlinks within the allowed directory that point to sensitive files outside the operational scope. The attack requires write access to or control over symlinks in the monitored directory, and affects file-reading operations in the MCP server. Patches should resolve symlinks before validation, not after.
Affected products
- SylphxAI filesystem-mcp 0.5.8
Timeline
- 2026-01-07: disclosed