PT-2025-41297 · Wonderwhy Er · Desktopcommandermcp

Crem + 1 · Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-11489

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wonderwhy-er DesktopCommanderMCP versions up to 0.2.13

Description A security issue has been identified in the isPathAllowed function within the src/tools/filesystem.ts file of wonderwhy-er DesktopCommanderMCP. This allows for symlink following, potentially leading to unauthorized access or manipulation of files. The attack requires local access and is considered difficult to exploit. The vendor acknowledges that the restriction features are not intended as hardened security boundaries and recommends using Desktop Commander with Docker for enhanced isolation when security is a primary concern. This vulnerability impacts products that are no longer supported by the maintainer.

Recommendations Versions prior to 0.2.14 are affected. Consider using Desktop Commander with Docker, which provides actual isolation.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

CVE-2025-11489

Affected Products

Desktopcommandermcp

References · 10

• 🔥 https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/219#issue-3343862329 · Exploit
• https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/219 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11489 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11489 · Security Note
• https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/219#issuecomment-3214114903 · Note
• https://twitter.com/CVEnew/status/1975997131673510153 · Twitter Post
• https://vuldb.com/?id.327606 · Note
• https://vuldb.com/?submit.668004 · Note
• https://t.me/CVEtracker/34468 · Telegram Post
• https://vuldb.com/?ctiid.327606 · Note