CVE-2025-67366
📋 TL;DR
CVE-2025-67366 is a critical path traversal vulnerability in @sylphxltd/filesystem-mcp v0.5.8 that allows attackers to bypass directory restrictions using symbolic links. This enables unauthorized reading of files outside the intended operational scope. Anyone using the vulnerable version of this MCP server for file content reading is affected.
💻 Affected Systems
- @sylphxltd/filesystem-mcp
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete file system compromise allowing attackers to read sensitive system files, configuration files, passwords, and other critical data.
Likely Case
Unauthorized access to files in parent directories or other accessible locations, potentially exposing application data, logs, or configuration files.
If Mitigated
Limited impact if proper file permissions and access controls restrict what files can be accessed even with path traversal.
🎯 Exploit Status
The vulnerability is straightforward to exploit by creating symbolic links within allowed directories pointing to restricted files. No authentication bypass is needed if the read_content tool is accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.5.9 or later
Vendor Advisory: https://github.com/sylphxltd/filesystem-mcp/issues/134
Restart Required: Yes
Instructions:
1. Stop the filesystem-mcp server
2. Update to version 0.5.9 or later: npm update @sylphxltd/filesystem-mcp
3. Restart the MCP server
🔧 Temporary Workarounds
Disable symbolic link following
linuxConfigure the operating system or filesystem to prevent symbolic link resolution in the allowed directories
chmod -h on Linux systems to remove symlink permissions
Use nofollow mount options if available
Restrict directory permissions
linuxSet strict file permissions on sensitive directories to prevent unauthorized access even if traversal occurs
chmod 700 /sensitive/directories
chown root:root /sensitive/directories
🧯 If You Can't Patch
- Disable the read_content tool entirely if not needed
- Run the MCP server with minimal privileges and in a chroot/jail environment
🔍 How to Verify
Check if Vulnerable:
Check the package version: npm list @sylphxltd/filesystem-mcp | grep filesystem-mcpCheck Version:
npm list @sylphxltd/filesystem-mcp | grep filesystem-mcpVerify Fix Applied:
Verify version is 0.5.9 or higher: npm list @sylphxltd/filesystem-mcp | grep 'filesystem-mcp@'📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns outside expected directories
- Multiple failed path resolution attempts followed by successful access
Network Indicators:
- Unexpected file read requests with path traversal patterns
- Requests accessing files with known sensitive names
SIEM Query:
source="filesystem-mcp" AND (path CONTAINS "../" OR path CONTAINS "/.." OR file_access OUTSIDE allowed_directories)