Check-then-open race lets MCP filesystem server read outside allowed directories

A local attacker can make the MCP filesystem server leak files outside its allowed directories: it checks a path, then reopens it by name, allowing a directory-to-symlink swap between the check and the open, according to advisory GHSA-p9cv-8g75-4xcg.

Affected

< 2.3.0; >= 2025.1.14 and <= 2026.8.31

Fixed

2.3.0 for the < 2.3.0 range; not specified by the advisory for the >= 2025.1.14 and <= 2026.8.31 range

The attacker must control or induce repeated read_text_file calls and be able to rename a directory inside an allowed tree while the server runs. The target file must be readable by the server user but unreadable directly by the attacker. Testing showed leaked contents only while the swap was running; controls without the race leaked nothing.

read_text_file validates with realpath and then opens the returned path again, so a directory symlink introduced after validation is followed; headFile and tailFile share the gap. Testing used @modelcontextprotocol/server-filesystem 2.1.0, published 2026-10-28.

Update to 2.3.0 where the advisory identifies that fix. For versions >= 2025.1.14 and <= 2026.8.31, the advisory specifies no patched version, so exposure remains unresolved.