PT-2025-27616 · Unknown · Filesystem

Jenn-Newton · Published 2025-07-01 · Updated 2025-08-31 · CVE-2025-53109

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Model Context Protocol Servers Filesystem versions prior to 0.6.4 or 2025.7.01 Model Context Protocol Servers Filesystem versions prior to 0.6.3 or 2025.7.1

Description Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). A flaw exists due to improper link resolution before file access. This can allow a remote attacker to gain unauthorized access to protected information. The issue involves a path validation bypass via symlink handling.

Recommendations Model Context Protocol Servers Filesystem versions prior to 0.6.4: Upgrade to version 0.6.4 or later. Model Context Protocol Servers Filesystem versions prior to 2025.7.01: Upgrade to version 2025.7.01 or later. Model Context Protocol Servers Filesystem versions prior to 0.6.3: Upgrade to version 2025.7.1 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2025-09365

CVE-2025-53109

GHSA-Q66Q-FX2P-7W4M

Affected Products

Filesystem

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53109.json · Exploit
• https://bdu.fstec.ru/vul/2025-09365 · Security Note
• https://osv.dev/vulnerability/GHSA-q66q-fx2p-7w4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53109 · Security Note
• https://github.com/modelcontextprotocol/servers · Note
• https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m · Note
• https://github.com/modelcontextprotocol/servers/commit/d00c60df9d74dba8a3bb13113f8904407cda594f · Note
• https://reddit.com/r/modelcontextprotocol/comments/1moenaz/mcp_vulnerabilities_every_developer_should_know · Reddit Post
• https://twitter.com/VulmonFeeds/status/1940476103644033205 · Twitter Post
• https://twitter.com/DeepEngineerHub/status/1952750693724610730 · Twitter Post
• https://twitter.com/grok/status/1941631204178132997 · Twitter Post
• https://twitter.com/_r_netsec/status/1940466270971089046 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1lqqirr/critical_vulnerabilities_discovered_in_anthropics · Reddit Post
• https://twitter.com/CVEnew/status/1940423932923797533 · Twitter Post