Skip to content

Hide Navigation Hide TOC

EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109) - ATR-2026-02024 (818c9d20-c239-59f5-a2e4-8ab2983a5342)

Detects the EscapeRoute symlink-bypass-to-code-execution chain (CVE-2025-53109, CVSS 8.4) reported by Cymulate against Anthropic's Filesystem MCP Server before 0.6.3 / 2025.7.1. The server followed symlinks without re-checking that the resolved target stayed inside the allowed directory. An attacker creates a symlink inside a writable (or prefix-bypassed) directory that points anywhere on the filesystem, then uses the filesystem MCP write_file to write through the symlink to a privileged target — the published PoC writes a malicious LaunchAgent plist to ~/Library/LaunchAgents/*.plist for persistent code execution at login (on macOS), or overwrites /etc/sudoers. This rule fires on the concrete signature: a filesystem-MCP symlink-create or write-through-symlink operation whose target is a known persistence/privileged path (LaunchAgents plist, /etc/sudoers, cron, authorized_keys, systemd unit). Fixed by realpath + post-resolution boundary re-validation in 0.6.3 / 2025.7.1.

Cluster A Galaxy A Cluster B Galaxy B Level
Indirect (a4a55526-2f1f-403b-9691-609e46381e17) MITRE ATLAS Attack Pattern EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109) - ATR-2026-02024 (818c9d20-c239-59f5-a2e4-8ab2983a5342) Agent Threat Rules 1
LLM Plugin Compromise (adbb0dd5-ff66-4b2f-869f-bfb3fdb45fc8) MITRE ATLAS Attack Pattern EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109) - ATR-2026-02024 (818c9d20-c239-59f5-a2e4-8ab2983a5342) Agent Threat Rules 1
Indirect (a4a55526-2f1f-403b-9691-609e46381e17) MITRE ATLAS Attack Pattern LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9) MITRE ATLAS Attack Pattern 2