EscapeRoute — Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110) - ATR-2026-02023 (3b4ff6cb-0da4-5346-8422-d3c02deded6b)
Detects the EscapeRoute directory-containment bypass (CVE-2025-53110, CVSS 7.3) reported by Cymulate against Anthropic's Filesystem MCP Server before 0.6.3 / 2025.7.1. The server enforced the allowed-directory boundary with a naive string prefix check: any requested path that merely starts with the allowed-directory string passed validation. An attacker requests a sibling directory that shares the allowed prefix — e.g. allowed dir "/private/tmp/allow_dir" is escaped with "/private/tmp/allow_dir_sensitive_credentials" — reading or writing files entirely outside the intended sandbox. This rule fires on the concrete filesystem-MCP access signature: a read_file/write_file/list_directory operation whose path takes an allowed-dir-like prefix and appends a suffix character that turns it into a different sibling directory (allow_dir -> allow_dir_secret). It does NOT fire on plain "../" traversal (covered elsewhere) or on legitimate paths that stay inside the boundary. Fixed by path.resolve + boundary-with-separator checks in 0.6.3 / 2025.7.1.