CVE-2025-67366

No known exploitation. EPSS puts it in the 49th percentile. No fix published yet.

CVSS 3.17.5High EPSS percentile49th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-01-07Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your systems run filesystem MCP version 0.5.8 and use its file-reading feature.
No fixed version has been published; ask the vendor or maintainer for a supported update timeline.
Until an update is available, remove untrusted symlinks from permitted folders and restrict access to the file-reading service.
Review access records for unexpected requests to read configuration files, credentials, or files outside the intended folder.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks path validity before resolving symlinks, while fs.readFile resolves symlinks automatically during file access. This allows attackers to bypass directory restrictions by leveraging symlinks within the allowed directory that point to external files, enabling unauthorized access to files outside the intended operational scope.

In plain language

Written by AI from the record

Filesystem MCP version 0.5.8 can let an outsider read files it should not, so small businesses using that version should act.

Path traversal in filesystem MCP’s read_content tool allows symlinks to bypass intended directory restrictions and disclose arbitrary readable files.

If you're affected

Sensitive file exposure
Configuration secret disclosure
Customer data exposure
Internal system information leak

What is it

This is a flaw in a tool meant to read files from an approved folder. It is like a receptionist checking that a visitor has entered through the right door, but then following a misleading sign that leads into a locked records room.

Who is affected

This matters to you if you use or run filesystem MCP to let applications, assistants, or users read server files. It is only a risk if an attacker can reach the file-reading tool or can influence files and links in its permitted folder.

How urgent is it

No attacks using this flaw have been publicly confirmed, but an attacker who can use the affected file-reading function may access sensitive files. Treat this as an amber issue: contain exposure promptly and obtain a vendor-supported fix when available.

What to do — in detail

Confirm whether filesystem MCP version 0.5.8 is deployed and identify every instance where the read_content tool is available to users, applications, or remote clients. Test the configured allowed directory for symlinks that point outside it, especially links created or controlled by untrusted users.

No fixed release or supported version is currently available. Do not attempt to treat an unverified newer release as a fix; obtain confirmation from the maintainer before upgrading.

If patching is delayed, disable or restrict read_content for untrusted clients, limit the service to the smallest necessary directory, remove symlinks from that directory, and prevent untrusted accounts from creating them. Monitor service and application logs for unexpected file-read requests, attempts to access configuration or credential files, and reads outside normal application paths.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies.

Technical context

CVSS v3.1 is 7.5 (High): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue is CWE-23 path traversal caused by validating a path before symlink resolution; the subsequent file read resolves symlinks and can escape the intended directory. No public exploit code is on record, and CISA KEV does not list the CVE. EPSS is 0.6% (48th percentile) with a flat trend. Exploit maturity is unproven publicly.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained.

Lifecycle

5 events over 252 days, from the signal feeds we watch.

2026-09-16Record updated
2026-01-29Record updated
2026-01-07Publishedweakness classified, att&ck mapped

Affected products

sylphx
- filesystem mcpLibraryDevTools & CI / build-test-tools

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact