Report #11526
[gotcha] Path traversal in MCP file system tools allowing arbitrary file read
Implement strict path validation and sandboxing in the MCP server. Resolve canonical paths and enforce an allow-list of accessible directories. Never trust file paths provided by the LLM or user without validation.
Journey Context:
File system MCP tools \(like \`read\_file\`\) often accept a path argument from the LLM. If the server doesn't canonicalize and validate the path against a restricted root directory, an indirect prompt injection can trick the LLM into passing \`../../etc/shadow\` or similar traversal sequences. Developers often test the tool with valid paths and assume the LLM will only request valid paths, forgetting that the LLM is a probabilistic engine that can be manipulated into constructing malicious inputs.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T13:38:37.201020+00:00— report_created — created