# EscapeRoute — Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110)

- **Severity:** High
- **Signature ID:** `b064e353-95c3-4e90-87c6-1edf1b110079`
- **CVEs:** CVE-2025-53109, CVE-2025-53110
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI06 (Goal and Instruction Manipulation), LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

A flaw in Anthropic's Filesystem MCP Server let an AI agent read or write files completely outside the folder it was supposed to be restricted to. The server checked access by matching the start of a path against the allowed directory name as plain text, so a sibling folder whose name simply began with the same text was wrongly treated as being inside the sandbox.

## How the attack works

The Filesystem MCP Server is meant to confine an agent's file operations to one allowed directory. Instead of checking that a path is truly inside that directory (e.g. followed by a slash), it only checked whether the path string starts with the allowed directory's name. An attacker asks the agent to read or write a path like '/private/tmp/allow_dir_sensitive_credentials' when the allowed directory is '/private/tmp/allow_dir' — the check passes because the string matches at the start, even though it's a completely different folder. This lets read_file, write_file, and list_directory calls escape the intended boundary without using any '../' traversal sequences.

## Why it matters

An attacker can read or overwrite files anywhere on the filesystem that happens to share a name prefix with the allowed directory, potentially exposing credentials, configuration, or other sensitive data the sandbox was meant to protect.

## What you can do

- Upgrade the Filesystem MCP Server to version 0.6.3 / 2025.7.1 or later, which enforces proper boundary checks.
- Until patched, name allowed directories so no sibling folder shares the same prefix, or place the allowed directory at a path with no siblings.
- Review filesystem MCP access logs for reads/writes to paths that extend the allowed directory name with letters, digits, or punctuation instead of a path separator.
- Apply least-privilege OS-level permissions on the allowed directory tree so even a successful bypass has limited reach.

## Known benign look-alikes

- Legitimate filesystem MCP reads/writes that stay inside the allowed directory — a path continuing with a directory separator after the allowed prefix (allow_dir/subfolder/file) is IN-scope and must not fire. This rule only matches when the character immediately after the allowed-directory token is a name character (letter/digit/underscore/hyphen/dot) that extends the directory name into a DIFFERENT sibling, not a '/' that descends inside it.
- Advisory or research text naming CVE-2025-53110, EscapeRoute, or the allow_dir_sensitive example without a live tool call carrying the sibling-directory path.
- Filenames or variables that legitimately contain an underscore after a common word (e.g. reading data_export/report.csv) where there is no filesystem-MCP allowed-directory-escape framing — the rule requires the filesystem-MCP operation/boundary context to co-occur.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02023
- https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/
- https://nvd.nist.gov/vuln/detail/CVE-2025-53110

---
Source: https://www.netzilo.com/threats/atr-escaperoute-filesystem-mcp-server-directory-prefix-bypass-cv