CVE-2025-53109 / CVE-2025-53110: Filesystem MCP server directory escape
- Product
- @modelcontextprotocol/server-filesystem (npm)
- CVE
- CVE-2025-53109, CVE-2025-53110
- Affected
- <= 0.6.2; >= 2025.1.14, < 2025.7.1
- Fixed in
- 2025.7.1
Last verified against sources: October 16, 2026
What happened
- According to Cymulate's research and GitHub Advisory Database's advisory (July 1, 2025), a naive prefix-matching check let any path that merely begins with the approved directory bypass the filter (CVE-2025-53110). [3][2]
- A crafted symlink could point anywhere on the filesystem and bypass access enforcement (CVE-2025-53109). [3][1]
Impact
- Reading and writing outside the directories the server was supposed to be limited to; Cymulate describes a path to code execution. [3]
What was done
How to protect yourself
- Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later. [3]
Sources
- GHSA-q66q-fx2p-7w4m (CVE-2025-53109) — GitHub Advisory Database
- GHSA-hc55-p739-j48w (CVE-2025-53110) — GitHub Advisory Database
- CVE-2025-53109 & CVE-2025-53110: EscapeRoute Breaks Anthropic's MCP Server — Cymulate
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Corrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.