CVE-2025-53109
1 advisory.
npm/@modelcontextprotocol/server-filesystem CVE-2025-53109: high, EPSS 0.77%
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
Action: Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.
npm i @modelcontextprotocol/server-filesystem@2025.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.6.2 |
| 2025.1.14 | 2025.7.1 | - |
Fixed versions
| 2025.7.1 |
Sources
- osv: GHSA-q66q-fx2p-7w4m
- https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m
- https://nvd.nist.gov/vuln/detail/CVE-2025-53109
- https://github.com/modelcontextprotocol/servers/commit/d00c60df9d74dba8a3bb13113f8904407cda594f
- https://github.com/modelcontextprotocol/servers
CVE-2025-53109 · published · modified · JSON