THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-67366 (HIGH 7.5) — @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path va

[NVD] CVE-2025-67366 (HIGH 7.5) — @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path va

lownvdPublished 2026-01-07

CVE-2025-67366 CVSS: 7.5 HIGH Published: 2026-01-07T17:16:01.893

@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks pa

Indicators of compromise

CVE-2025-67366cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-67366