CVE-2026-79534

The mark3labs mcp-filesystem-server v0.11.1 is vulnerable to a Directory Traversal attack due to improper link resolution within the validatePath function in filesystemserver/handler/helper.go. When filepath.EvalSymlinks returns os.IsNotExist for a dangling symlink , the system's fallback logic i...

EUVD-2026-89359

mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath filesystemserver/handler/helper.go. When filepath.EvalSymlinks returns os.IsNotExist for a dangling symlink, the fallback validates only the parent directory and returns...