GHSA-q66q-fx2p-7w4m: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
GHSA-q66q-fx2p-7w4m · CVE-2025-53109
- Advisory ID
- DURIN-MCP-2026-000004
- Severity
- high
- Publication state
- published
- Updated
Summary
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
This is a public advisory summary. Its publication state does not establish whether a particular deployed connection is affected or has been remediated.
Complete the browser check below for affected versions, remediation, revision history and attributed assessment evidence.