Report #80368
[gotcha] MCP resource URIs enable path traversal when servers map URIs directly to filesystem paths
Validate and sanitize all resource URIs on the server side. Implement strict allowlists of accessible paths. Reject resource requests containing path traversal sequences, absolute paths outside allowed directories, or encoded variants such as URL-encoded double dots. Never construct filesystem paths directly from user-supplied resource URI components. Use a mapping layer between URIs and filesystem locations.
Journey Context:
MCP servers that implement the resources capability serve content at resource URIs. If the server maps resource URIs directly to filesystem paths without validation, an attacker can craft URIs with path traversal to read arbitrary files. This is a classic directory traversal vulnerability, but it is particularly dangerous in MCP because the LLM agent can be instructed to request these URIs via prompt injection. The full attack chain: injected instruction causes the LLM to call resources/read with a crafted URI, the server reads a sensitive file, the content is returned to the LLM, and then it is exfiltrated via another tool call. Many community-built MCP server implementations do minimal URI validation because the resources capability feels like a simple file-serving feature, not an attack surface. The gotcha is that resource URIs look like opaque identifiers but are often used as filesystem paths with no sanitization.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T17:30:00.568297+00:00— report_created — created