EUVD-2026-89359
GHSA-9c87-p3cg-99hj
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Local MCP interface (AV:L); AC:H because a pre-existing dangling symlink in an allowed dir is required; PR:N/UI:N; S:C and I:H for out-of-sandbox file writes; no read or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helper.go). When filepath.EvalSymlinks returns os.IsNotExist for a dangling symlink, the fallback validates only the parent directory and returns the unresolved path, so write_file (and modify_file, copy_file, move_file, create_directory) follows a pre-existing dangling symlink located inside an allowed directory and creates a file outside the configured allowed directories.
AnalysisAI
A directory traversal flaw in mark3labs mcp-filesystem-server v0.11.1 lets a caller write files outside the server's configured allowed directories by routing a write-capable tool through a pre-existing dangling symlink that already sits inside an allowed path. The bug is integrity-only (no read or denial-of-service impact) and requires the broken symlink to exist beforehand, which limits realistic exploitation; the only confirmed affected version from available data is v0.11.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a pre-existing dangling (broken) symlink located inside one of the server's configured allowed directories; the attacker then triggers one of the write-capable tools (write_file, modify_file, copy_file, move_file, create_directory) targeting a path through that symlink. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-urgency defense-in-depth flaw, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so there is no fixed version to upgrade to and the primary action is to eliminate the precondition and shrink the attack surface. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in the create_file tool served by the 03-lovepreetSingh MCP application's /api/mcp route lets remote, una
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac
OS command injection in mbailey VoiceMode through version 8.10.1 lets an authenticated local attacker who can reach the
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today