Executive brief
faf-mcp is a Model Context Protocol (MCP) server that provides file read/write tools for AI agents and LLM assistants. The server fails to properly restrict file paths supplied by callers, allowing attackers to read sensitive files (SSH keys, AWS credentials, environment variables) or write arbitrary files anywhere the server process has permission. An attacker can exploit this by injecting malicious tool calls through compromised content (web pages, README files, tickets) processed by an LLM using the server.
Technical details
The vulnerability is a path traversal (CWE-22) and external file path control (CWE-73) issue affecting the `getProjectPath()` function and the `faf_read`/`faf_write` file tools. The root cause is that caller-supplied `path` arguments are resolved using home-directory expansion (`~`) and `path.resolve()` without confinement to a trusted project directory. Absolute paths and `../` traversals bypass the weak denylist-only restrictions, allowing read access to any file the server process can access (e.g., `/etc/passwd`, `~/.ssh/id_rsa`, `~/.aws/credentials`) and write access outside the project. The server communicates via stdio, so exploitation occurs through crafted tool calls—either from a direct MCP client or via prompt injection when an LLM processes attacker-controlled content. Patch 2.1.3 fixes this by canonicalizing paths through symlinks, rejecting absolute paths and `../` escapes, restricting context reads to `.faf`/`.fafm` files, and confining general file ops to the project root (with `FAF_ALLOWED_ROOTS` override).
Affected products
- Wolfe-Jam faf-mcp <=2.1.2
Timeline
- 2026-06-11: disclosed: Vulnerability disclosed; patch 2.1.3 released
- 2026-08-19: advisory: GitHub Advisory published (GHSA-j4r7-8ph4-43g3)