PT-2026-1880 · Unknown · Fast-Filesystem-Mcp

Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-67364

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions fast-filesystem-mcp version 3.4.0

Description The software contains a path traversal issue in its file operation tools, including the fast read file function. This is due to insufficient path validation that does not resolve symbolic links to their actual physical paths. The safePath and isPathAllowed functions utilize path.resolve(), which does not handle symlinks, allowing attackers to bypass directory access restrictions. By creating symlinks within permitted directories that point to restricted system paths, attackers can circumvent validation checks and gain access to unauthorized files when these symlinks are accessed through valid path references.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2025-67364

GHSA-J893-M93W-JWJW

Affected Products

Fast-Filesystem-Mcp

References · 6

• 🔥 https://github.com/efforthye/fast-filesystem-mcp/issues/10 · Exploit
• https://osv.dev/vulnerability/CVE-2025-67364 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j893-m93w-jwjw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67364 · Security Note
• https://github.com/efforthye/fast-filesystem-mcp · Note
• https://twitter.com/CVEnew/status/2008959526805147787 · Twitter Post