CVE-2025-53109: Model Context Protocol filesystem server symlink handling bypass

# CVE-2025-53109: Model Context Protocol filesystem server symlink handling bypass

https://gcdradar.vercel.app/incidents/cve-2025-53109-model-context-protocol-filesystem-server-syml · AIR-2025-0301 · closed 2025-07-01

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-07-01
- AI role: Attack on AI
- Products: @modelcontextprotocol/server-filesystem
- CVE ids: CVE-2025-53109
- CVSS: 7.3

## Summary

The Model Context Protocol filesystem server is vulnerable to path validation bypass through symlink handling within allowed directories. Users must update to the patched version to prevent unintended file exposure.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-07-02: CVE-2025-53109: Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). (https://nvd.nist.gov/vuln/detail/CVE-2025-53109)
- 2025-07-01: CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling (https://github.com/advisories/GHSA-q66q-fx2p-7w4m)

## Sources

- 2025-07-01 GitHub Advisory Database: CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling https://github.com/advisories/GHSA-q66q-fx2p-7w4m
- 2025-07-02 NVD: CVE-2025-53109: Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). https://nvd.nist.gov/vuln/detail/CVE-2025-53109

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.