High severity · published Jul 2, 2025
CVE-2025-53109
Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling
7.3
CVSS
0.8%
EPSS
No
On KEV
Description
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
servers · modelcontextprotocol
< 0.6.4; < 2025.7.01 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53109
github.com
https://github.com/modelcontextprotocol/servers/commit/d00c60df9d74dba8a3bb13113f8904407cda594f
github.com
https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m
More from servers
9.1
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
8.8
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
7.3
CVE-2025-53110
Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix
7.1
CVE-2025-68144
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
6.5
CVE-2026-27735
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries