Listen to this Post
How the CVE Works
The vulnerability exists in the Model Context Protocol (MCP) server for Git. When the server is started with the `–repository` flag, it is designed to restrict all operations to a single, specified directory path. However, versions prior to 2025.12.17 failed to properly validate subsequent `repo_path` arguments provided during tool calls. The server did not resolve the absolute paths of the configured directory and the requested target, nor did it check if the requested path was contained within the allowed boundary. This missing validation allowed an attacker to use path traversal techniques (e.g., using `../` sequences) or leverage symbolic links to escape the restricted directory. Consequently, Git operations like reading commits, checking status, or viewing logs could be performed on other, unauthorized repositories that the server process had filesystem access to, leading to information disclosure.
Platform: mcp-server-git
Version: < 2025.12.17
Vulnerability: Path Traversal
Severity: Moderate
date: 2025-12-17
Prediction: 2025-12-24
What Undercode Say:
Analytics
A 2025 analysis found that 43% of public MCP servers had command injection flaws. The ecosystem is fragmented, with packages often in different registries (e.g., @some-org/mcp-server-git), leading to setup errors and security oversights.
Bash Commands & Codes
Example of starting the vulnerable server with a restricted path
mcp-server-git --root /path/to/allowed-repo
In agent configuration (agent.json)
{
"servers": {
"git": {
"command": "mcp-server-git",
"args": ["--root", "/path/to/allowed-repo"]
}
}
}
How Exploit
An attacker would craft a malicious `repo_path` argument, such as `../../../etc/passwd` or a path to a private repository, during a tool call to the server. The server, lacking validation, would resolve this path and perform Git operations on it. This could also be combined with the earlier `git_init` vulnerability (GHSA-5cgr-j3jf-jw3v) which allowed repository creation anywhere, to first plant a target and then access it.
Protection from this CVE
Upgrade `mcp-server-git` to version 2025.12.17 or newer. The fix adds proper path resolution and validation, ensuring all requested paths are within the configured root directory.
Impact
This path traversal flaw allows unauthorized access to sensitive data in other Git repositories on the same filesystem, leading to information disclosure. It violates the intended security boundary of the `–repository` flag.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
