7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53110

CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue.

Thank you to Elad Beber (Cymulate) for reporting these issues.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53110

CVE-2025-53110:

7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@modelcontextprotocol/server-filesystem	npm	<= 0.6.2
@modelcontextprotocol/server-filesystem	npm	>= 2025.1.14, < 2025.7.1	2025.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch cc99bdabdcad93a58877c5f3ab20e21d4394423d reveals two main types of vulnerabilities in the @modelcontextprotocol/server-filesystem package: a path traversal vulnerability and a symlink race condition (TOCTOU) vulnerability.

Path Traversal: The root cause of the path traversal vulnerability was in the validatePath function in src/filesystem/index.ts. It used a simple startsWith check to validate if a requested path was within an allowed directory. This allowed an attacker to access unintended directories by crafting a path that shared a prefix with an allowed directory (e.g., /allowed/dir-evil when /allowed/dir is permitted). The fix was to introduce a new, more robust validation function, isPathWithinAllowedDirectories, which ensures that the path is not just a prefix but a true subdirectory by checking for a trailing path separator.
Symlink Race Condition (TOCTOU): The functions responsible for writing to the filesystem, namely applyFileEdits and the request handler for the write_file tool, were vulnerable to race conditions. An attacker could pass a valid path for the initial check (validatePath) and then, in the small window before the file is written, replace that path with a symbolic link pointing to a sensitive file elsewhere on the system. The subsequent write operation would then follow the symlink and overwrite the target file. The patch mitigates this by employing atomic operations. For new files, it uses the 'wx' flag with fs.writeFile to ensure exclusive creation, which fails if a file or symlink already exists. for existing files, it writes to a temporary file and then performs an atomic fs.rename, which is not susceptible to this type of symlink-based attack.

Both of these vulnerabilities could lead to unauthorized file access and modification, posing a significant security risk. The identified vulnerable functions are the key locations where these flaws existed and were subsequently patched.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.