# Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689)

- **Severity:** High
- **Signature ID:** `b0df6f7d-e36a-4220-83c5-afc86203ad2a`
- **CVEs:** CVE-2025-66689
- **MITRE ATLAS:** AML.T0056 (Extract LLM System Prompt), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), ASI06 (Goal and Instruction Manipulation), LLM02 (Sensitive Information Disclosure), LLM07 (System Prompt Leakage)

## Summary

Zen MCP Server tries to stop AI agents from reading sensitive files like SSH keys or /etc/shadow by comparing requested paths against a blocklist of dangerous strings. Because it checks the raw text of the path instead of resolving it first, an attacker can dress up a blocked path with tricks like '../', './' or extra slashes so it looks different from the blocklist entry but still points at the same protected file.

## How the attack works

An attacker asks the agent to open a file path that has been deliberately mangled — for example wrapping a blacklisted directory in extra '../' segments, adding a '/./' segment, using redundant slashes, or bouncing through a same-directory reference. The server's dangerous-path check compares the path as a literal string against its blocklist and finds no match, since it never normalizes the path first. The underlying filesystem, however, resolves the path normally and returns the contents of the sensitive file — such as an SSH private key or system credential file — to the attacker.

## Why it matters

An attacker with the ability to submit file paths to the agent can read SSH keys, password files, or other protected system files that the blocklist was meant to block, leading to credential theft and further compromise.

## What you can do

- Canonicalize (resolve symlinks, '..', '.', and redundant slashes) any user-supplied path before comparing it against a blocklist or allowlist.
- Prefer an allowlist of permitted directories over a blocklist of forbidden ones for file access.
- Restrict the MCP server's filesystem permissions so it cannot read credential files or system directories regardless of application-level checks.
- Log and review file-access requests containing traversal artifacts ('../', './', or repeated slashes) near sensitive path segments.

## Known benign look-alikes

- Documentation or tutorials that mention ../ relative imports without a sensitive credential/system target adjacent to it
- Legitimate absolute file paths to project source under /home/<user>/project that contain no /../ , /./ , or redundant-slash artefact
- Security write-ups quoting the CVE that describe canonicalization in prose rather than presenting an inline non-canonical path to a sensitive file

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00578
- https://www.sentinelone.com/vulnerability-database/cve-2025-66689/
- https://nvd.nist.gov/vuln/detail/CVE-2025-66689

---
Source: https://www.netzilo.com/threats/atr-zen-mcp-server-path-traversal-blacklist-bypass-via-non-canon