mark3labs mcp-filesystem-server v0.11.1 contains a Directory Traversal flaw due to an improper link resolution in validatePath. When a symlink points to a non‑existent target, the code validates only the parent directory and returns the unresolved path. This allows an attacker to instruct write_file, modify_file, copy_file, move_file, or create_directory operations to resolve a dangling symlink within an allowed directory and create a file outside the configured safe location. The impact is the ability to create or modify arbitrary files on the server, potentially compromising confidentiality, integrity, or availability of the host.

Vendor: mark3labs Product: mcp-filesystem-server Affected Version: v0.11.1 (only this version explicitly mentioned).

The CVSS score of 5.9 indicates a medium severity vulnerability. The EPSS score of < 1% shows a very low probability of exploitation in the wild, yet the flaw still permits arbitrary file writes outside permitted directories. The vulnerability is not listed in CISA KEV. From the description, the exploit requires an attacker to send file operation requests to the server containing a symlink path pointing to a non‑existent target. Successful exploitation would give an attacker read/write access to the filesystem beyond the intended boundaries, potentially compromising confidentiality, integrity, or availability of the host.