CVE-2025-67364 (CNNVD-202601-1197)
中文标题:
fast-filesystem-mcp 安全漏洞
英文标题:
fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file opera...
漏洞描述
中文描述:
fast-filesystem-mcp是efforthye个人开发者的一个模型上下文协议服务器。 fast-filesystem-mcp 3.4.0版本存在安全漏洞，该漏洞源于路径验证不当，无法解析符号链接，可能导致绕过目录访问限制。
英文描述:
fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. The safePath and isPathAllowed functions use path.resolve() which does not handle symlinks, allowing attackers to bypass directory access restrictions by creating symlinks within allowed directories that point to restricted system paths. When these symlinks are accessed through valid path references, the validation checks are circumvented, enabling access to unauthorized files.
CWE类型:
标签:
受影响产品
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (adp)
HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-67364 |
2026-01-08 02:08:10 | 2026-01-12 02:12:26 |
| NVD | nvd_CVE-2025-67364 |
2026-01-09 03:00:09 | 2026-01-12 02:28:05 |
| CNNVD | cnnvd_CNNVD-202601-1197 |
2026-01-11 06:15:11 | 2026-01-12 02:38:12 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202601-1197
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']