What is CVE-2025-67366?

CVE-2025-67366 is a high-severity vulnerability in Sylphx Filesystem-Mcp, classified under Relative Path Traversal. CVSS score: 7.5/10. Published 2026-01-07.

How severe is CVE-2025-67366?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Sylphx Filesystem-Mcp

CVE-2025-67366

@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks path validity before resolving symlinks, while fs.readFile resolves symlinks automatically during file access. This allows attackers to bypass directory restrictions by leveraging symlinks within the allowed directory that point to external files, enabling unauthorized access to files outside the intended operational scope.

EPSS: 0.005 (42.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Sylphx Filesystem-mcp — versions 0.5.8
N/a — versions n/a

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

References

cve@mitre.org (Exploit, Third Party Advisory)
cve@mitre.org (Product)

Frequently asked questions

What is CVE-2025-67366?: CVE-2025-67366 is a high-severity vulnerability in Sylphx Filesystem-Mcp, classified under Relative Path Traversal. CVSS score: 7.5/10. Published 2026-01-07.
How severe is CVE-2025-67366?: High severity. CVSS v3 base score is 7.5 out of 10.