@MODELCONTEXTPROTOCOL/SERVER-FILESYSTEM · GHSA-hhwq-wxfx-cj7g · AI agents & MCP
FIX → 2.0.1
The @modelcontextprotocol/server-filesystem tool list_directory_with_sizes calls fs.stat on symlinked children without checking their targets, so symlinks inside an allowed directory reveal the size of files outside it. An attacker who can place a symlink in the allowed tree, or steer an agent into calling the tool, learns the existence and approximate size of outside files, but not their contents.
first public Oct 25, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run the filesystem MCP server with an allowed directory that may contain symlinks to files outside it. Exposure requires a symlink in the allowed tree and a client or agent that calls list_directory_with_sizes; direct reads through the same symlink remain denied.
Not affected if default-config, no-symlinks-in-allowed-dir
Who cares claude-code, filesystem, mcp, node, npm
npm ls @modelcontextprotocol/server-filesystem and look for versions >= 1.0.0 and < 2.0.1, or >= 2025.7.1 and <= 2026.8.31.list_directory_with_sizes validates only the requested directory path. It then iterates over entries and calls fs.stat(entryPath) on each child without validating the child path. fs.stat() follows symlinks, so a symlink inside an allowed directory that points to a file outside the allowed directory causes the tool to disclose the outside target's file size.
Direct reads through the same symlink are correctly denied by read_text_file, so this is a residual metadata bypass in list_directory_with_sizes on the current npm release rather than a report of the already-published 2025 symlink or prefix CVEs.
Known repository advisories GHSA-vjqx-cfc4-9h6v, GHSA-5cgr-j3jf-jw3v, GHSA-9xwc-hfwc-8w59, and GHSA-j22h-9j4x-23w5 affect mcp-server-git, not @modelcontextprotocol/server-filesystem.
The two relevant filesystem advisories are GHSA-q66q-fx2p-7w4m and GHSA-hc55-p739-j48w. They affect versions before 2025.7.1. This report is reproduced against @modelcontextprotocol/server-filesystem@2026.1.14, after those fixes. It is also narrower: direct file-content access remains denied, but still leaks outside-target file size by following symlinks during child metadata collection.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.0.1
@modelcontextprotocol/server-filesystem: move to 2.0.1 (npm will not offer it automatically because the 2025.x and 2026.x date versions rank higher; install it explicitly).list_directory_with_sizesRepository source:
servers/src/filesystem/index.ts:465-473Published npm package:
touchstone-poc/mcp-modelcontextprotocol-server-filesystem/published-package/package/dist/index.js:353-360@modelcontextprotocol/server-filesystem@2026.1.14.read_text_file on the outside file. It is denied.read_text_file on the symlink inside the allowed directory. It is denied.list_directory_with_sizes on the allowed directory. It returns 1.50 KB for the symlink, leaking the outside target's size.PoC command:
node touchstone-poc\mcp-modelcontextprotocol-server-filesystem\poc-list-directory-symlink-metadata.js
Observed output:
{
"directOutsideReadDenied": true,
"symlinkReadDenied": true,
"leakedSizeInListing": true,
"outsideSecretSize": 1536,
"listingText": "[FILE] link-to-outside-secret.bin 1.50 KB\n\nTotal: 1 files, 0 directories\nCombined size: 1.50 KB"
}
Full transcript:
touchstone-poc/mcp-modelcontextprotocol-server-filesystem/poc-list-directory-symlink-metadata-output.jsonAn attacker who can place or preserve a symlink inside an allowed directory can cause an MCP client or agent to call list_directory_with_sizes and disclose metadata about files outside the allowed directory. The confirmed leaked field is file size. This can reveal the existence and approximate size of sensitive files such as private keys, local databases, credentials, or other user files when a symlink to those files is present in the allowed tree.
@modelcontextprotocol/server-filesystem@2026.1.14 with an allowed directory.list_directory_with_sizes.Validate each child path before following it:
const entryPath = path.join(validPath, entry.name);
const validEntryPath = await validatePath(entryPath);
const stats = await fs.stat(validEntryPath);
Alternatively, use fs.lstat() and report symlink metadata without following the target. If target metadata is intentionally shown, the target must be resolved and checked against the allowed-directory policy before calling fs.stat().
Credit: @cybercraftsolutionsllc
@modelcontextprotocol/server-filesystem moved from date versions (2025.x, 2026.x) to semantic versions in 1.0.0. Package managers rank 2.0.1 below every 2025.x and 2026.x version, so they will not offer it as an upgrade and Dependabot will not open one. If you are on a date version, install the fix explicitly: npm install @modelcontextprotocol/server-filesystem@2.0.1 (or @latest).