A critical path traversal vulnerability in the filesystem-mcp server allows unauthenticated remote attackers to access sensitive files outside the intended directory scope.

This is a path traversal vulnerability originating from improper symlink validation in the resolvePath function. An unauthenticated attacker can leverage symbolic links to bypass directory restrictions and access unauthorized files on the host system.

The ability for an unauthenticated user to read arbitrary files from the filesystem poses a severe risk to data confidentiality. If the host system contains sensitive configuration files, credentials, or proprietary data, this vulnerability could lead to a total compromise of system integrity. With a CVSS score of 7.5, this high-severity flaw necessitates immediate attention to prevent unauthorized information disclosure.

Immediate Action: Review the official GitHub repository for updates and move to a version that implements robust path normalization and symlink verification. If no patch is available, disable the filesystem-mcp service until a security fix is verified.

Proactive Monitoring: Monitor application access logs for unusual read requests or attempts to traverse directory structures using symlink patterns.

Compensating Controls: Implement strict filesystem permissions for the service account running the MCP server, ensuring it can only access the minimum necessary files required for operation.

Public Exploit Available: No confirmed published, weaponized exploit (e.g., Metasploit/ExploitDB).

Given the exposure of filesystem contents to unauthenticated actors, this vulnerability represents a significant security risk. Administrators should audit their current deployment of filesystem-mcp and restrict access to the service while awaiting an official patch. Prioritize applying the vendor fix as soon as it is released to close this vector for unauthorized file access.