MCPA-2025-0005
highpath-traversalCVSS 7.3
@modelcontextprotocol/server-filesystem symlink bypass enables full filesystem access (CVE-2025-53109)
A crafted symlink inside an allowed directory of the reference Filesystem MCP server could point anywhere on the filesystem and bypass access enforcement, giving attackers read/write access to critical files outside the sandbox and a path to code execution.
The second 'EscapeRoute' vulnerability reported by Cymulate Research Labs in Anthropic's Filesystem MCP Server reference implementation. Versions of Filesystem prior to 0.6.4 or 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Attackers can drop malicious code and fully compromise the host from an unprivileged position. Fixed in 0.6.4 / 2025.7.1.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @modelcontextprotocol/server-filesystem | >= 0.0.0, < 0.6.4 >= 2025.1.14, < 2025.7.1 |
Identifiers
CVE-2025-53109GHSA-q66q-fx2p-7w4mCWE-59
References
- advisory https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m
- advisory https://nvd.nist.gov/vuln/detail/CVE-2025-53109
- report https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/
- fix https://github.com/modelcontextprotocol/servers/commit/d00c60df9d74dba8a3bb13113f8904407cda594f
Timeline
- Published: 2025-07-02
Credits
- Elad Beber (Cymulate Research Labs)