CVE-2025-67364: 
JavaScript vulnerability analysis and mitigation

CVE-2025-67364 is a path traversal vulnerability via symlink bypass in fast-filesystem-mcp, a high-performance Model Context Protocol (MCP) server providing filesystem access for Claude and other AI assistants. The vulnerability affects version 3.4.0 (and all versions ≤ 3.4.0) of the npm package. It was reported on October 12, 2025, published to the NVD on January 7, 2026, and reviewed in the GitHub Advisory Database on January 8, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Issue).

The root cause is improper path validation classified as CWE-24 (Path Traversal: '../filedir'). Specifically, the safePath and isPathAllowed functions in utils.ts (lines 70–83) use Node.js's path.resolve() to validate user-supplied paths, which resolves relative path components but does not dereference symbolic links to their actual physical targets. An attacker who can create a symlink within an allowed directory pointing to a restricted system path (e.g., /home/zsw/test.txt -> /usr/zsw/test.txt) can then supply the symlink path to file operation tools such as fast_read_file; the validation passes because the symlink resides in an allowed directory, but the subsequent fs.open() call in enhanced-handlers.ts (line 62) follows the symlink and reads the restricted target file. The fix requires replacing path.resolve() with fs.realpath() during validation so that symlinks are fully resolved before access control checks are applied (Github Advisory, GitHub Issue).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the host system that the MCP server process has permission to access, bypassing the configured directory access restrictions entirely. The confidentiality impact is high — sensitive files such as credentials, configuration files, private keys, or other restricted data could be exfiltrated. Integrity and availability are not directly impacted by this vulnerability, but exposed credentials could enable further lateral movement or privilege escalation (Github Advisory, Feedly).

A proof-of-concept exploit demonstrating the symlink bypass technique is publicly available in the GitHub issue tracker (GitHub Issue). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit over the network. The EPSS score is approximately 0.044% (0.024% per GitHub Advisory), indicating a currently low probability of active exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify systems running fast-filesystem-mcp version 3.4.0 or earlier, particularly those exposing an MCP server endpoint accessible over the network (e.g., Claude Desktop integrations or similar AI assistant deployments).
2. Identify allowed directories: Use the fast_list_allowed_directories tool or review server configuration to determine which directories are within the permitted access scope.
3. Create a malicious symlink: On the target system (or via a writable allowed directory), create a symbolic link within an allowed directory that points to a restricted target file, e.g., ln -s /etc/passwd /home/allowed_dir/evil_link.
4. Craft the exploit request: Send a tools/call MCP request targeting fast_read_file with the symlink path as the argument:

{
  "method": "tools/call",
  "params": {
    "name": "fast_read_file",
    "arguments": {
      "path": "/home/allowed_dir/evil_link",
      "encoding": "utf-8",
      "auto_chunk": true
    }
  }
}

5. Bypass validation: The safePath() function validates /home/allowed_dir/evil_link as permitted (it resides in an allowed directory), but does not resolve the symlink.
6. Read restricted file: The fs.open() call follows the symlink and returns the contents of the restricted target file (e.g., /etc/passwd), completing the unauthorized file read (GitHub Issue).

• Network: Unexpected or repeated MCP tools/call requests to fast_read_file (or other file operation tools) referencing paths that are symbolic links; requests targeting sensitive system paths indirectly through symlinks within allowed directories.
• File System: Presence of unexpected symbolic links within directories configured as allowed paths for the MCP server, particularly links pointing to sensitive locations such as /etc/, /root/, /var/, or credential stores.
• Logs: MCP server access logs showing fast_read_file calls to symlink paths that resolve outside the configured allowed directories; repeated file read requests to the same symlink path from the same source.
• Process: The MCP server process (Node.js) opening file descriptors to paths outside the configured allowed directories, observable via lsof or auditd file access auditing (GitHub Issue).

The GitHub Advisory (GHSA-j893-m93w-jwjw) lists all versions ≤ 3.4.0 as affected and currently indicates no patched version has been formally published to npm. Users should monitor the fast-filesystem-mcp repository for a patched release and upgrade immediately when available. As a workaround, restrict write access to allowed directories to prevent creation of malicious symlinks, and consider disabling the MCP server or restricting network access to trusted clients only. The proper code-level fix requires replacing path.resolve() with fs.realpath() in the safePath and isPathAllowed functions so that symlinks are fully resolved before access control checks (Github Advisory, GitHub Issue).

The vulnerability received brief coverage on security-focused social media accounts including posts on Mastodon and Bluesky shortly after disclosure in January 2026. Red Hat tracked the CVE in their security advisory database. No significant vendor statements or notable researcher commentary beyond the original issue report have been identified (Feedly).