Skip to main content
Allows attackers to access files outside of intended directories.

​
How to resolve

Sanitize file paths: Use path sanitization functions like os.path.basename() to strip directory components and os.path.realpath() to resolve symbolic links and relative paths. Validate against base directory: After normalization, verify that the resolved absolute path starts with the intended base directory. Use allowlists: Where possible, maintain an allowlist of permitted files or directories rather than attempting to block malicious patterns. Reject suspicious input: Block paths containing traversal sequences (”../”, ”..\”) before processing.

​
Risk

Governance/Compliance Path traversal vulnerabilities violate multiple security standards:
  • OWASP Top 10 2025 (A01:2025 - Broken Access Control): Allows unauthorized access to files outside the intended directory structure.
  • CWE-22 (Path Traversal): Improper limitation of pathname to a restricted directory enables access to arbitrary files.
  • NIST SP 800-53 (AC-3): Fails to enforce access control policies for file system resources.
  • OWASP MCP Top 10 (MCP05:2025 - Command Injection & Execution): Path traversal in MCP tools can be leveraged alongside command execution to access restricted resources.
Security An attacker can read sensitive files such as configuration files, credentials, source code, or system files that should be inaccessible. In some cases, path traversal can also enable writing to arbitrary locations, leading to code execution or data corruption. The impact is especially concerning in MCP servers that process files on behalf of users, as it may expose data across organizational boundaries.

​
Explanation

Path traversal vulnerabilities allow attackers to access files and directories outside the intended scope by manipulating file path parameters with sequences like ”../”. The scanner identifies file operations that lack proper path normalization and validation. This can be prevented by using path sanitization functions like os.path.basename() to remove directory traversal components and validating that resolved paths remain within allowed directories.

​
Specifications

Trigger
  • MCP server scan detects file operations on user-controlled paths without normalization or validation against path traversal sequences
Severity
  • HIGH
Applies to: MCP Server