# MCP filesystem directory-size listing follows symlinks and leaks outside-file sizes

Canonical: https://www.clawpit.io/egret/29
Published: 2026-11-10T06:02:44+00:00
Reviewed by: Egret AI managing editor


The MCP filesystem tool `list_directory_with_sizes` follows symlinks when listing children, so an inside symlink to an outside file leaks that file's size. Researchers @cybercraftsolutionsllc reproduced it on `@modelcontextprotocol/server-filesystem@2026.1.14`. Direct reads of that outside file remain blocked; only its size leaks.

An attacker who can place or preserve a symlink inside the allowed directory can cause an MCP client or agent to call the listing tool and learn an outside file's size and existence. The reproduction returned 1.50 KB for a 1,536-byte outside file; file content was not exposed. Preconditions are an outside-target symlink in the allowed tree and attacker influence over the listing call, directly or through prompt injection or repository content.

Two version ranges are affected: date versions from 2025.7.1 through 2026.8.31, for which the advisory specifies no patched version, and semantic versions 1.0.0 up to but not including 2.0.1, fixed in 2.0.1. Because package managers rank 2.0.1 below date versions, users on a date release must install the fix explicitly with `npm install @modelcontextprotocol/server-filesystem@2.0.1` or `@latest`. Researchers advise validating each child path before calling `fs.stat`, or using `fs.lstat` and checking any resolved target.

## Evidence and scope

- Affected versions: [{"product": "@modelcontextprotocol/server-filesystem (npm)", "affected": ">= 2025.7.1, <= 2026.8.31", "fixed": "Not specified by advisory"}, {"product": "@modelcontextprotocol/server-filesystem (npm)", "affected": ">= 1.0.0, < 2.0.1", "fixed": "2.0.1"}]
- Fixed versions: [{"product": "@modelcontextprotocol/server-filesystem (npm)", "fixed": "2.0.1"}]
- Exploitation: Not established by supplied evidence
- Limitations: Patched version not specified for date-versioned range; known exploitation not established by supplied evidence; only file size/existence leakage confirmed, not content access.

## Original sources

- [MCP server advisories](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hhwq-wxfx-cj7g)

AI-assisted reporting. External findings belong to the credited researchers.