Filesystem Mcp
Approved changes feed: RSS · Atom
cpe:2.3:a:sylphx:filesystem-mcp:0.5.8:*:*:*:*:node.js:*:*part: a version: 0.5.8 update: *
| Vendor | Sylphx (257026e0-89d2-5e89-96d2-2359c3d6af41) |
|---|---|
| Product | Filesystem Mcp (c7cf2138-c398-5eac-bf41-83beeabf2dc2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-67366 |
vulnerable | 2026-06-08 07:41:19.810748 |
Details available
@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks path validity before resolving symlinks, while fs.readFile resolves symlinks automatically during file access. This allows attackers to bypass directory restrictions by leveraging symlinks within the allowed directory that point to external files, enabling unauthorized access to files outside the intended operational scope.
Published: 2026-01-07T00:00:00.000Z
Updated: 2026-01-07T17:18:19.832Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.