Secuno
ENNL
Book demo

CVE-2025-67364

Efforthye Fast-filesystem-mcp path traversal

7.5 HIGHPublic exploitEPSS 0.63%
  1. Published7 Jan 2026

Description

fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. The safePath and isPathAllowed functions use path.resolve() which does not handle symlinks, allowing attackers to bypass directory access restrictions by creating symlinks within allowed directories that point to restricted system paths. When these symlinks are accessed through valid path references, the validation checks are circumvented, enabling access to unauthorized files.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Efforthye Fast-filesystem-mcp3.4.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1089808.8
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via…
CVE-2026-977308.5
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File…
CVE-2026-661408.4
Exim before 4.99.5 allows directory traversal to access files outside of the spool…
CVE-2026-228108.2
Joplin is an open source note-taking and to-do application that organises notes and…
CVE-2026-403188.5
SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and…
CVE-2026-398139.8
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through…

Frequently asked

Is CVE-2025-67364 being actively exploited?

CVE-2025-67364 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.63%.

How severe is CVE-2025-67364?

CVE-2025-67364 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.63% probability of exploitation.

Which products are affected by CVE-2025-67364?

Affected products include Efforthye Fast-filesystem-mcp.

How do I fix CVE-2025-67364?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-67364 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.