iceener/files-stdio-mcp-server: sandbox escape in fs_search via a symlinked directory (recursive walker validates only the top level)
iceener/files-stdio-mcp-server allows a read-side sandbox escape: fs_search follows symlinked directories while the recursive walker validates confinement only at the top level.
A vulnerability report describes a read-side sandbox escape in iceener/files-stdio-mcp-server, an MCP server for text-based file access that explicitly promises 'Sandboxed filesystem access. Only these paths are available'. The fs_search tool can follow symlinked directories outside the allowed paths, and the recursive directory-listing walker used by fs_search (and by fs_read) validates confinement only at the top level. The same flaw affects fs_read's directory-listing walker. No CVE identifier was assigned in the provided report text.
- fs_search escapes the promised sandbox via symlinked directories
- Recursive walker validates path confinement only at the top level
- Same flaw affects fs_read directory listing
- Affects an MCP server marketed with sandboxed filesystem access
Posted by Eve on Sep 09 Vulnerability report — read-side sandbox escape in iceener/files-stdio-mcp-server Project: github.com/iceener/files-stdio-mcp-server (75*). A "MCP Server for interacting with text-based files" that makes an explicit confinement promise: "Sandboxed filesystem access. Only these paths are available", plus a CRITICAL RULES block. Affected tool: fs_search (and the same flaw in fs_read's directory-listing walker). Class:...
This source does not provide full text. Read it at seclists.org.