MCPA-2025-0004
highpath-traversalCVSS 7.3
@modelcontextprotocol/server-filesystem path validation bypass via colliding path prefix (CVE-2025-53110)
The reference Filesystem MCP server used naive prefix matching to enforce its allowed-directories sandbox: any path that merely begins with an approved directory string (e.g. /private/tmp/allowed_dir_evil) bypassed the filter, allowing unrestricted listing, reading and writing outside the intended sandbox.
One of the two 'EscapeRoute' vulnerabilities reported by Cymulate Research Labs in Anthropic's Filesystem MCP Server reference implementation. Breaks the server's core security boundary, opening the door to data theft and potential privilege escalation. Fixed in 0.6.4 / 2025.7.1.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @modelcontextprotocol/server-filesystem | >= 0.0.0, <= 0.6.2 >= 2025.1.14, < 2025.7.1 |
Identifiers
CVE-2025-53110GHSA-hc55-p739-j48wCWE-22
References
- advisory https://github.com/advisories/GHSA-hc55-p739-j48w
- advisory https://nvd.nist.gov/vuln/detail/CVE-2025-53110
- report https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/
Timeline
- Published: 2025-07-01
Credits
- Elad Beber (Cymulate Research Labs)