{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0003",
  "aliases": [
    "CVE-2025-53109",
    "CVE-2025-53110"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "MCP filesystem servers permit path traversal through symlink and calendar-version paths",
  "details": "## What the vulnerability is\n\nThe MCP filesystem server can follow a symlink that appears to remain inside an allowed directory while resolving to an unintended file. The referenced advisory covers the npm package `@modelcontextprotocol/server-filesystem` and records two release schemes: semver before `0.6.4` and calendar versions before `2025.7.1` are affected. The impact is unauthorized access to files outside the intended directory boundary.\n\n## Which configuration is exposed\n\nThe exposed configuration is any MCP server entry whose package is `pkg:npm/@modelcontextprotocol/server-filesystem`. The matcher encodes only that package identity, so it applies whether the server is started directly, through an MCP client, or through a package runner. It does not encode a particular allowed path, symlink, transport, or user interaction; those are conditions of exploitation described by the advisory rather than fields available in this seed matcher.\n\n## How ACVE detects it\n\nACVE reads `mcpServers[].package` and matches the filesystem-server PURL. It does not read `mcpServers[].resolvedVersion`, the selected directory list, filesystem permissions, or symlink targets. A package launched through `npx` may therefore have an unknown resolved version and remain a broad finding. The affected record carries both semver and calendar-version events, so operators must compare their installed release against the scheme they use.\n\n## Fix\n\n1. Upgrade the semver package to `0.6.4` or later, or use calendar release `2025.7.1` or later when that is the release scheme in use.\n2. Rebuild the lockfile and review allowed directories and symlinks after upgrading.\n\n## Grounding needed\n\n`acve advisory ground` must confirm that `0.6.4` and `2025.7.1` are the correct fixed events for the two published release schemes.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@modelcontextprotocol/server-filesystem"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.4"
            }
          ]
        },
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2025.0.0"
            },
            {
              "fixed": "2025.7.1"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "MCP",
        "name": "pkg:npm/@modelcontextprotocol/server-filesystem"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.4"
            }
          ]
        },
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2025.0.0"
            },
            {
              "fixed": "2025.7.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53109"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-53109"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "vulnClasses": [
        "path-traversal"
      ],
      "cwe": [
        "CWE-22"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI02 Tool Misuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "some": "mcpServers",
        "where": {
          "field": "package",
          "op": "eq",
          "value": "pkg:npm/@modelcontextprotocol/server-filesystem"
        }
      },
      "fix": {
        "summary": "Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.",
        "actions": [
          {
            "type": "upgrade",
            "target": "mcp:pkg:npm/@modelcontextprotocol/server-filesystem",
            "to": "2025.7.1",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:22Z",
          "found": true,
          "aliasesConfirmed": [
            "CVE-2025-53109",
            "CVE-2025-53110",
            "GHSA-hc55-p739-j48w",
            "GHSA-q66q-fx2p-7w4m"
          ],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": [
            {
              "type": "CVSS_V4",
              "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:H/SI:H/SA:H"
            },
            {
              "type": "CVSS_V4",
              "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:H/SI:H/SA:H"
            }
          ]
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:22Z",
          "found": true,
          "cvss": 7.3,
          "published": "2025-07-02T15:15:27.670"
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:22Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:22Z",
          "confirmed": [],
          "missing": [
            "npm:@modelcontextprotocol/server-filesystem@0.6.4"
          ]
        }
      }
    }
  }
}