Report #13626
[gotcha] Resource template URI parameters enable path traversal and SSRF attacks
Validate and sanitize all URI template parameters server-side. Implement strict allowlisting of accessible resource paths. Never pass user-influenced input directly into filesystem paths or internal URLs. Use chroot or jail for file access. Apply rate limiting per resource pattern.
Journey Context:
MCP resource templates use URI templates like file:///home/user/docs/\{name\}. If the LLM passes crafted values for template parameters—driven by prompt injection or adversarial user input—the server may follow path traversal using dot-dot-slash sequences or SSRF attacks against internal services. The LLM itself will not maliciously craft these, but if compromised via prompt injection, it becomes a proxy for the attacker. Resource templates look like simple URL patterns but are actually user-controlled input points requiring the same sanitization as any web API parameter. The surprise is that developers think of resources as static content, but templates make them dynamic and attackable.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T19:15:41.411731+00:00— report_created — created