CVE-2025-53110: Filesystem Prefix Bypass in @modelcontextprotocol/server-filesystem

The core of this vulnerability lies in how the @modelcontextprotocol/server-filesystem handles file access requests. Specifically, if a request's prefix matches an allowed directory, the system may inadvertently grant access to files outside the intended scope. An attacker could craft malicious requests to bypass access controls and retrieve sensitive data stored within the filesystem. The potential impact includes unauthorized access to configuration files, source code, or any other data accessible through the filesystem interface. While the description doesn't specify a direct path to remote code execution, the ability to read arbitrary files could be a stepping stone for further exploitation, such as information disclosure leading to privilege escalation.

1. Reserved2025-06-25
2. Published2025-07-01
3. Modified2025-07-02
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-53110 is to upgrade to version 0.6.4 or later of the @modelcontextprotocol/server-filesystem package. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing stricter input validation on file access requests to prevent prefix matching bypasses. This could involve whitelisting allowed prefixes or implementing more robust path sanitization. Additionally, review and restrict file permissions to minimize the potential impact of unauthorized access. After upgrading, confirm the fix by attempting to access files outside the intended directory scope and verifying that access is denied.