CVE-2025-67364: fast-filesystem-mcp Path Traversal Vulnerability
Summary
CVE-2025-67364: fast-filesystem-mcp has a Path Traversal vulnerability. Affects fast-filesystem-mcp versions < 3.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-filesystem-mcp is an npm package designed for efficient file operations, including reading and writing files in a fast manner. It is widely used in applications that require file manipulation. However, version 3.4.0 of this package has been identified to contain a critical vulnerability that allows attackers to exploit path traversal issues, potentially leading to unauthorized access to sensitive files on the system.
Vulnerability Detail
The vulnerability in fast-filesystem-mcp arises from improper path validation in its file operation tools, specifically in the fast_read_file function. The package fails to correctly resolve symbolic links to their actual physical paths, allowing attackers to create symlinks within allowed directories that point to restricted system paths. This circumvents directory access restrictions, enabling unauthorized access to sensitive files. The vulnerability is classified under CWE-24 (Path Traversal) and has a CVSS score of 7.5, indicating a high severity risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate file paths before accessing them. For example, you can restrict file access to a predefined set of directories and reject any paths that include symbolic links. Here is a sample code snippet to illustrate this:
const path = require('path');
const fs = require('fs');
function safeReadFile(filePath) {
const allowedDir = '/allowed/directory';
const resolvedPath = path.resolve(filePath);
if (!resolvedPath.startsWith(allowedDir)) {
throw new Error('Access denied');
}
return fs.readFileSync(resolvedPath);
}
Conclusion
The fast-filesystem-mcp package has a critical path traversal vulnerability that can lead to unauthorized file access. It is essential to update to a patched version to mitigate this risk. Implementing the suggested workaround can provide temporary relief until an update is feasible.
See every vulnerability recorded for fast-filesystem-mcp →
FAQ
The vulnerability is a path traversal issue that allows attackers to access unauthorized files by exploiting symbolic links.
Version 3.4.0 of fast-filesystem-mcp is affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement the suggested workaround to validate file paths and restrict access until you can update the package.
The CVSS score of this vulnerability is 7.5, indicating a high severity risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for fast-filesystem-mcp.
