https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:37:50.588397+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-09365 bdu:2025-09365 2026-10-06T17:37:50.665820+00:00 bdu:2025-09365 https://cve.radiocsirt.org/vuln/euvd-2026-246339 EUVD-2026-246339 2026-10-06T17:37:50.665861+00:00 EUVD-2026-246339 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53109 fkie_cve-2025-53109 2026-10-06T17:37:50.665876+00:00

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.

 https://cve.radiocsirt.org/vuln/ghsa-q66q-fx2p-7w4m GHSA-q66q-fx2p-7w4m — @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling 2026-10-06T17:37:50.665906+00:00

Affected: npm: @modelcontextprotocol/server-filesystem

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve.

Thank you to Elad Beber (Cymulate) for reporting these issues.