ACVE-2025-0003

The configuration

Configuration label

@modelcontextprotocol/server-filesystem

Affected entries

• npm: @modelcontextprotocol/server-filesystem — SEMVER (introduced 0; fixed 0.6.4); ECOSYSTEM (introduced 2025.0.0; fixed 2025.7.1)
• MCP: pkg:npm/@modelcontextprotocol/server-filesystem — SEMVER (introduced 0; fixed 0.6.4); ECOSYSTEM (introduced 2025.0.0; fixed 2025.7.1)

Matcher

• some mcpServers
  • package eq "pkg:npm/@modelcontextprotocol/server-filesystem"

Why it is exploitable

What the vulnerability is

The MCP filesystem server can follow a symlink that appears to remain inside an allowed directory while resolving to an unintended file. The referenced advisory covers the npm package @modelcontextprotocol/server-filesystem and records two release schemes: semver before 0.6.4 and calendar versions before 2025.7.1 are affected. The impact is unauthorized access to files outside the intended directory boundary.

Which configuration is exposed

The exposed configuration is any MCP server entry whose package is pkg:npm/@modelcontextprotocol/server-filesystem. The matcher encodes only that package identity, so it applies whether the server is started directly, through an MCP client, or through a package runner. It does not encode a particular allowed path, symlink, transport, or user interaction; those are conditions of exploitation described by the advisory rather than fields available in this seed matcher.

How ACVE detects it

ACVE reads mcpServers[].package and matches the filesystem-server PURL. It does not read mcpServers[].resolvedVersion, the selected directory list, filesystem permissions, or symlink targets. A package launched through npx may therefore have an unknown resolved version and remain a broad finding. The affected record carries both semver and calendar-version events, so operators must compare their installed release against the scheme they use.

Fix

1. Upgrade the semver package to 0.6.4 or later, or use calendar release 2025.7.1 or later when that is the release scheme in use.
2. Rebuild the lockfile and review allowed directories and symlinks after upgrading.

Grounding needed

acve advisory ground must confirm that 0.6.4 and 2025.7.1 are the correct fixed events for the two published release schemes.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-53109
• CVE-2025-53110

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.

Validation

No validation entries recorded.

Grounding

• OSV: found; aliases: CVE-2025-53109, CVE-2025-53110, GHSA-hc55-p739-j48w, GHSA-q66q-fx2p-7w4m; checked-at 2026-09-20T02:43:22Z
• NVD: found; checked-at 2026-09-20T02:43:22Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:22Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-53109

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-53109