CVE-2025-67366

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Relative Path Traversal pada sylphx filesystem mcp. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks path validity before resolving symlinks, while fs.readFile resolves symlinks automatically during file access. This allows attackers to bypass directory restrictions by leveraging symlinks within the allowed directory that point to external files, enabling unauthorized access to files outside the intended operational scope.

Rincian

Terbit di NVD

7 Januari 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sylphxltd/filesystem-mcp/issues/134 exploit · advisory pihak ketiga
• https://github.com/sylphxltd/filesystem-mcp product