# Anthropic Filesystem MCP Server: Directory Access Bypass via Improper Path Validation

Anthropic filesystem MCP server validated allowedDirectories with startsWith, so sibling paths sharing a prefix like /mnt/finance/data-archived bypassed the allowlist and were readable by the AI.

- Payout: Research
- Severity: medium
- Program: Anthropic
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-03
- CVE: CVE-2025-53109
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2025/anthropic-filesystem-mcp-server-bypass/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-anthropic-filesystem-mcp-server-bypass
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:medium tech:nodejs technique:source-review vuln:access-control vuln:misconfiguration vuln:path-traversal

**Target:** MCP filesystem server validatePath in index.ts
**Root cause:** validatePath only checks that the requested path string startsWith an allowed directory string, without enforcing a path separator boundary or that the path is within the directory.
**Steps:**
1. Configure allowedDirectories to `/mnt/finance/data` per README
2. Create sibling `/mnt/finance/data-archived`
3. Request read of `/mnt/finance/data-archived/...` via the MCP server
4. validatePath's `.startsWith('/mnt/finance/data')` returns true, granting access
**How found:** Curious about access control, read the public index.ts source and noticed validatePath used a .startsWith string comparison on allowedDirectories.
**Exploitation:** An AI client with access to the MCP server can read or edit any sibling file/directory whose absolute path shares the allowlisted prefix, escaping the intended scope.
**Insight:** When auditing allowlist path checks, look for prefix string comparisons lacking a trailing separator or realpath containment check; sibling dirs sharing a prefix (data vs data-archived) silently pass.