EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109) - ATR-2026-02024 (818c9d20-c239-59f5-a2e4-8ab2983a5342)
Detects the EscapeRoute symlink-bypass-to-code-execution chain (CVE-2025-53109, CVSS 8.4) reported by Cymulate against Anthropic's Filesystem MCP Server before 0.6.3 / 2025.7.1. The server followed symlinks without re-checking that the resolved target stayed inside the allowed directory. An attacker creates a symlink inside a writable (or prefix-bypassed) directory that points anywhere on the filesystem, then uses the filesystem MCP write_file to write through the symlink to a privileged target — the published PoC writes a malicious LaunchAgent plist to ~/Library/LaunchAgents/*.plist for persistent code execution at login (on macOS), or overwrites /etc/sudoers. This rule fires on the concrete signature: a filesystem-MCP symlink-create or write-through-symlink operation whose target is a known persistence/privileged path (LaunchAgents plist, /etc/sudoers, cron, authorized_keys, systemd unit). Fixed by realpath + post-resolution boundary re-validation in 0.6.3 / 2025.7.1.