CVE-2025-53109
BaseFortify
Publication date: 2025-07-02
Last updated on: 2025-07-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Model Context Protocol Servers, specifically versions of Filesystem prior to 0.6.4 or 2025.7.01. It allows access to unintended files via symbolic links (symlinks) within directories that are otherwise allowed. This means an attacker could potentially use symlinks to access files that should not be accessible.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to files that should be restricted. This could result in exposure of sensitive information or data leakage, potentially compromising system security and user privacy.
What immediate steps should I take to mitigate this vulnerability?
Users are advised to upgrade to version 0.6.4 or 2025.7.01 of the Model Context Protocol Servers to resolve the vulnerability.