CVE-2026-79534: Mark3Labs mcp-filesystem-server vulnerability
mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helper.go). When filepath.EvalSymlinks returns os.IsNotExist for a dangling symlink, the fallback validates only the parent directory and returns the unresolved path, so writefile (and modifyfile, copyfile, movefile, createdirectory) follows a pre-existing dangling symlink located inside an allowed directory and creates a file outside the configured allowed directories.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs to be able to invoke a filesystem write-related operation, such as write_file, modify_file, copy_file, move_file, or create_directory, against a pre-existing dangling symlink within an allowed directory. The symlink must point to a location outside the configured allowed directories.
Which configurations are exposed?
Configurations that permit write-related filesystem operations in allowed directories containing dangling symlinks are exposed. The provided information does not state whether dangling symlinks are present in a default configuration.
How can I assess whether my deployment may be affected?
Check whether the server is running v0.11.1 and inspect configured allowed directories for dangling symlinks. Determine whether clients able to call write_file, modify_file, copy_file, move_file, or create_directory could target those symlink paths.
What can be done while patching is not available?
Remove or replace dangling symlinks from allowed directories, especially any that resolve outside the configured allowed directories. Restrict access to write-related filesystem operations for untrusted clients.