{
 "id": "AIR-2025-0301",
 "slug": "cve-2025-53109-model-context-protocol-filesystem-server-syml",
 "title": "CVE-2025-53109: Model Context Protocol filesystem server symlink handling bypass",
 "summary": "The Model Context Protocol filesystem server is vulnerable to path validation bypass through symlink handling within allowed directories. Users must update to the patched version to prevent unintended file exposure.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "@modelcontextprotocol/server-filesystem"
 ],
 "incident_date": "2025-07-01",
 "incident_date_precision": "day",
 "first_reported": "2025-07-01",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-q66q-fx2p-7w4m",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling",
   "published_at": "2025-07-01"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53109",
   "publisher": "NVD",
   "title": "CVE-2025-53109: Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP).",
   "published_at": "2025-07-02"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2025-53109",
  "mcp",
  "symlink"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}