Zen MCP Server path-traversal blacklist bypass via non-canonical paths (CVE-2025-66689) - ATR-2026-00578 (89886b04-43f2-530c-8e69-a5b90836795b)
CVE-2025-66689 (CWE-22). The Zen MCP server's is_dangerous_path() blocks sensitive files with an exact-string blacklist but never canonicalizes the path before comparison, so a path that still resolves to a protected target slips through when it is wrapped in normalization tricks: a blacklisted prefix followed by ../ (/etc/shadow/../../../home/user/.ssh/id_rsa), a same-directory bounce (/home/user/.ssh/../.ssh/id_rsa), a /./ no-op (/etc/./shadow), or redundant slashes (/etc//shadow). The discriminator from the existing deep-../-chain rule (ATR-2026-00569) and the clean-credential-path rule (ATR-2026-00113) is that the SENSITIVE target token sits immediately adjacent to a normalization/traversal artefact — neither a clean credential path nor a bare ../ chain alone matches here.