Report #42106
[gotcha] MCP resource templates enable path traversal and enumeration
Validate and canonicalize all URI template parameters before resolving resource paths. Restrict resource access to explicitly allowed directory trees using allowlists. Implement path canonicalization checks \(resolving symlinks and .. sequences\) to prevent directory traversal. Never allow resource templates to resolve paths outside a designated sandbox.
Journey Context:
MCP resource templates use URI templates \(RFC 6570\) to define parameterized resources. A template like file:///home/\{user\}/docs/\{path\} looks convenient but allows the LLM—or a malicious server via tool descriptions—to traverse the filesystem by substituting ../ sequences or absolute paths. The gotcha is that resource templates feel like safe structured APIs, but they are actually dynamic path construction functions. Without strict validation and canonicalization, they become filesystem traversal vectors. This is especially dangerous because the LLM will happily construct any path a tool description tells it to, and resource reads do not typically require user approval the way tool calls do.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-19T01:08:43.311432+00:00— report_created — created