Disclosed vulnerability
EscapeRoute: path-containment and symlink bypasses in Anthropic's Filesystem MCP server (CVE-2025-53110, CVE-2025-53109)
AIR-2025-0052 AIR record · 2025-07-anthropic-mcp-filesystem-escaperoute
From the supporting source
A naive prefix-matching check lets any path that simply begins with the approved directory (e.g., /private/tmp/allowed_dir) bypass the filter, allowing unrestricted listing, reading and writing outside the intended sandbox.cymulate.com
The record
Disclosed
2025-07-01
Vendor
Anthropic
Product
@modelcontextprotocol/server-filesystem
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the MCP server read and wrote files outside its sandbox on the agent's behalf
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Prompt or tool argument controlled path
Impact type
Sandbox escape, Arbitrary file read, Arbitrary file write, Remote code execution, Unauthorized data access, Scope violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all deployments of Anthropic's reference Filesystem MCP server prior to 2025.7.1; commonly run with the user's full privileges
Capability abused
Defense & remediation
Recorded defense
allowed-directory allowlist enforced by naive path.startsWith() prefix matching
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
npm @modelcontextprotocol/server-filesystem 2025.7.1, released 2025-07-01
Taxonomy & references
Curator notes
Discovered by Cymulate Research Labs (Elad Beber). CVSS 7.3 (CVE-2025-53110 containment bypass) and 8.4 (CVE-2025-53109 symlink bypass). Reported 2025-03-30, vendor ack 2025-05-01, patched 2025-07-01. Johann Rehberger (embracethered.com) independently documented the directory-prefix bypass. Code execution demonstrated by writing macOS LaunchAgents. Also reported as: 'Anthropic Filesystem MCP server: directory access bypass via startsWith path validation (CVE-2025-53109)'.
Supporting sources
Cite as
Enkrypt AI. "EscapeRoute: path-containment and symlink bypasses in Anthropic's Filesystem MCP server (CVE-2025-53110, CVE-2025-53109)". AIR, AIR-2025-0052. https://agentincident.vercel.app/i/AIR-2025-0052/ (accessed 2026-10-19).