EUVD-2026-26281Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required, no interaction; partial read/write outside allowed dirs; no scope change as impact stays within the server process boundary.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is_path_allowed of the file server.py of the component read_file_tool/write_file_tool. Such manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.1.0 is capable of addressing this issue. The name of the patch is 45364545fc60dc80aadcd4379f08042d3d3d292e. Upgrading the affected component is advised.
AnalysisAI
Path traversal in geekgod382 filesystem-mcp-server 1.0.0 allows unauthenticated remote attackers to read or write files outside the server's intended allowed directories by supplying path sequences that bypass the flawed is_path_allowed() check in server.py. Both read_file_tool and write_file_tool are affected, enabling arbitrary file exfiltration or overwrite on the host. A public exploit POC exists on GitHub; SSVC rates this as automatable with partial technical impact, though EPSS at 0.05% (16th percentile) reflects the product's niche deployment footprint rather than low exploitability. No CISA KEV listing. Vendor-released patch v1.1.0 is available.
Technical ContextAI
filesystem-mcp-server is a Python-based Model Context Protocol (MCP) server that exposes filesystem operations - specifically file read and write - to AI models and agents. The vulnerable component is the is_path_allowed() function in server.py, which is supposed to restrict file access to a set of permitted directories before servicing tool calls. CWE-22 (Path Traversal) indicates that user-controlled path input is not sufficiently normalized or canonicalized before comparison against the allow-list, permitting traversal sequences (e.g., ../) to escape permitted boundaries. The CPE cpe:2.3:a:geekgod382:filesystem-mcp-server:*:*:*:*:*:*:*:* covers all versions up to and including 1.0.0. The patch (commit 45364545) refactors path-allowance logic into a dedicated config.py with ALLOWED_PATHS and a corrected is_path_allowed(), per README changes visible in the diff; however, the specific corrected path-normalization code is not shown in the provided diff, so the precise fix mechanism is inferred rather than directly observed.
RemediationAI
Upgrade to filesystem-mcp-server v1.1.0, which resolves the path traversal via commit 45364545fc60dc80aadcd4379f08042d3d3d292e; the release is available at https://github.com/geekgod382/filesystem-mcp-server/releases/tag/v1.1.0. If immediate upgrade is not feasible, restrict the MCP server's network exposure to localhost or a tightly controlled internal segment to reduce the attack surface, noting this does not eliminate risk if the server is accessed by untrusted clients. Additionally, run the server process under a least-privilege OS account confined by OS-level filesystem controls - such as a chroot jail, Linux namespaces, AppArmor profile, or container filesystem isolation - so that even a successful traversal cannot escape the process's accessible directory tree; this is an effective compensating control but adds operational overhead. Monitor server logs for path segments containing .. sequences as an indicator of exploitation attempts.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today