The allowed directory was a string comparison
There is now enough of a public record on MCP filesystem security to stop guessing and start reading. I went through it. The cases are more similar to each other than I expected, and the pattern is worth naming. EscapeRoute — Anthropic's own Filesystem MCP Server. Two CVEs, both in every version before npm 2025.7.1. Found 30 March 2025, patched 1 July 2025. CVE-2025-53110 (CVSS 7.3) is a directory containment bypass. The server checked whether a requested path started with an approved directory.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.