MCP filesystem read validation was vulnerable to a timed symlink swap

The filesystem MCP server checked that a requested path resolved inside an approved directory. It then opened the pathname again. That gap let a local actor replace an intermediate directory with a symlink after validation but before the read, making the server open a file outside its configured root.

The advisory reports an isolated two-user Linux reproduction: the attacker could not directly read the protected file, but the MCP process could, and a timed swap returned matching contents. It requires an attacker-writable parent, a reachable target and sufficient server permissions. Package 2.3.0 is listed as fixed. This was a demonstrated test, not a disclosed remote mass breach.

This is a confused-deputy effect, not a claim that the attacker already had permission to open the outside secret. The two-user reproduction establishes a concrete privilege separation failure under tight race conditions. It is distinct from the companion move_file bug because the demonstrated operation does not relocate the protected file.