npm/@modelcontextprotocol/server-filesystem CVE-2025-53110: high, EPSS 0.58%
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix
Action: Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.
npm i @modelcontextprotocol/server-filesystem@2025.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.6.2 |
| 2025.1.14 | 2025.7.1 | - |
Fixed versions
| 2025.7.1 |
Sources
- osv: GHSA-hc55-p739-j48w
- https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hc55-p739-j48w
- https://nvd.nist.gov/vuln/detail/CVE-2025-53110
- https://github.com/modelcontextprotocol/servers/commit/cc99bdabdcad93a58877c5f3ab20e21d4394423d
- https://github.com/modelcontextprotocol/servers
CVE-2025-53110 · published · modified · JSON