Evidence · DiggingBeagle record
MCP filesystem read_text_file TOCTOU race leaks forbidden files across different Linux users
Upstream reference filesystem MCP advisory contains a two-user Linux proof in which a local symlink swap after realpath validation makes read_text_file return an outside file under the MCP process identity. It is not a general arbitrary unauthenticated remote read.
- Source role
- primary disclosure
Evidence record
Upstream reference filesystem MCP advisory contains a two-user Linux proof in which a local symlink swap after realpath validation makes read_text_file return an outside file under the MCP process identity. It is not a general arbitrary unauthenticated remote read.
Claim-level citations (1)
- supportsMCP filesystem read validation was vulnerable to a timed symlink swap: GHSA-p9cv-8g75-4xcg documents a read_text_file time-of-check/time-of-use path swap that retrieved a file outside allowedDirectories in a two-user Linux test.
Security advisory, two-user race reproduction, affected versions and fix