Description

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-07T23:16:53.297Z",
  "pubdate": "2026-09-07T23:16:53.297Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw in MCP versions prior to 0.30.0, specifically regarding the handling of filesystem path arguments within MCP tool execution.\nThe vulnerability is classified as a Path Traversal (CWE-22) issue. By injecting directory traversal sequences (e.g., ../) into tool arguments, an attacker can bypass intended directory restrictions imposed by the application.\nThe impact is significant, as it grants an attacker the ability to interact with the underlying filesystem, including reading, creating, overwriting, or deleting arbitrary Markdown files accessible to the server process.\nThe risk is high, as the exploit does not appear to require complex authentication or specialized privileges beyond the capability to trigger the vulnerable tool function.\nAttackers can leverage this to exfiltrate sensitive information, corrupt project data, or potentially achieve remote code execution depending on the server configuration and file contents.",
  "technicalDetails": "The root cause of this vulnerability is the lack of robust sanitization and path normalization for filesystem path arguments passed to MCP tools. The application fails to validate that requested file operations are confined within the designated project directory boundaries.\nThe vulnerable component is the argument parsing logic responsible for handling filesystem-related tool operations. When an MCP tool accepts a path as an argument, the application blindly trusts the user-supplied input without verifying it against a whitelist or restricting it via chroot-like mechanisms.\nExploitation is achieved by supplying malicious strings containing directory traversal sequences (e.g., '../') in the path argument of an MCP tool request. For example, if the application expects a path relative to '/home/user/project', an attacker can provide '../../../../etc/passwd' or other sensitive paths. Because the application logic does not neutralize these sequences, the server-side process resolves the path relative to the root of the filesystem rather than the intended project directory.\nThe attack flow proceeds as follows: 1. An attacker identifies an MCP tool that facilitates filesystem operations (read, write, delete). 2. The attacker crafts a payload utilizing directory traversal patterns to escape the application's working directory. 3. The attacker submits this payload via the MCP interface. 4. The server-side process executes the requested operation (file read/write/delete) using the resolved absolute path. 5. The application returns the contents of a sensitive file to the user, or performs destructive operations on files that the server process has permission to modify.\nThe vulnerability affects all versions of MCP prior to 0.30.0. The ability to successfully exploit this flaw depends on the permissions of the user account running the server process; any file readable or writable by the server process is susceptible to access or modification. This includes system configuration files, project source code, and user data stored in Markdown format."
}