MCP server-filesystem case-variant path bypasses symbolic link check, allowing file creation outside permitted directories
MCP server-filesystem released security advisory GHSA-4gxg-m5jx-9j57: on case-insensitive file systems (the default on macOS and Windows), spelling the name of a symbolic link within an allowed directory with different letter casing allows creating files and directories outside the allowed directory via create_directory, write_file, and move_file. Affected versions are 2026.8.31 (no fix version yet) and versions 1.0.0 and above but before 2.0.1; 2.0.1 has fixed it. It is a regression introduced in 2026.8.31. The cause is that resolveUnicodeEquivalentPath() compares path components as strings, so LINK does not match link, and returns the remaining path without calling realpath(); the operating system follows the symbolic link when creating the file.
The author provides complete reproduction steps and a fix patch, and notes that when upgrading from a date-based version, package managers will not automatically recommend 2.0.1, so it must be installed manually.