CVE-2025-11489: DesktopCommanderMCP Path Traversal Flaw

CVE-2025-11489 Overview

CVE-2025-11489 is a symlink following vulnerability [CWE-59] in wonderwhy-er DesktopCommanderMCP through version 0.2.13. The flaw resides in the isPathAllowed function within src/tools/filesystem.ts. An attacker with local access can create symbolic links that bypass path-based access restrictions enforced by the Model Context Protocol (MCP) server. The vendor characterizes the restriction feature as an LLM guardrail rather than a hardened security boundary and recommends Docker isolation for security-critical deployments. This vulnerability only affects releases that are no longer supported by the maintainer.

Critical Impact
Local attackers can leverage symbolic links to escape configured filesystem restrictions in DesktopCommanderMCP, potentially exposing files outside the allowed directory scope to LLM-driven operations.

Affected Products

wonderwhy-er DesktopCommanderMCP versions up to and including 0.2.13
The vulnerable component is src/tools/filesystem.ts (isPathAllowed function)
Affected releases are no longer supported by the maintainer

Discovery Timeline

2025-10-08 - CVE-2025-11489 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11489

Vulnerability Analysis

DesktopCommanderMCP is a Model Context Protocol server that gives large language models controlled access to a host's filesystem and shell. The isPathAllowed function is intended to verify whether a requested path falls within a configured allowlist before file operations are executed on behalf of the LLM.

The check does not adequately resolve symbolic links before evaluating the target path. An attacker with local access can plant a symlink inside an allowed directory that points to sensitive files or directories outside the allowlist. When the LLM later reads or writes through that path, the operation follows the symlink and touches the attacker-chosen target.

The attack requires local execution and elevated exploitation complexity, which limits real-world impact. The vendor has publicly stated that path restrictions were designed as LLM guardrails rather than a security boundary.

Root Cause

The root cause is improper link resolution [CWE-59] in the path validation logic of isPathAllowed. The function evaluates the supplied path string against configured allowed roots without canonicalizing symbolic links to their real filesystem targets before the authorization decision.

Attack Vector

Exploitation requires a local, authenticated user who can write into a directory reachable by DesktopCommanderMCP. The attacker creates a symbolic link inside an allowed path that points to a file or directory outside the configured scope. When the MCP client (an LLM agent) invokes a filesystem tool through the server, the symlink is dereferenced during file access, and the operation succeeds against the attacker-chosen target. The public GitHub issue at DesktopCommanderMCP Issue #219 discusses the behavior and the maintainer's position.

Because no verified proof-of-concept code has been published for this issue, the exploitation mechanics are described here in prose. See the VulDB entry #327606 for additional detail.

Detection Methods for CVE-2025-11489

Indicators of Compromise

Unexpected symbolic links created inside directories that DesktopCommanderMCP is configured to expose to an LLM
MCP server log entries showing file reads or writes whose canonical path resolves outside the configured allowlist
Local user processes issuing ln -s or equivalent symlink() calls that target sensitive paths such as /etc, ~/.ssh, or credential stores immediately before MCP tool invocations

Detection Strategies

Compare each MCP filesystem operation's raw path against its realpath()-resolved canonical path, and alert when they diverge outside the allowlist
Enable filesystem auditing (auditd on Linux, fs.notify on macOS) on directories exposed to DesktopCommanderMCP to record symlink creation events
Review MCP server access logs for anomalous access patterns that touch dotfiles or system configuration paths

Monitoring Recommendations

Baseline the set of symbolic links present in directories exposed to the MCP server and alert on deviations
Monitor the child processes spawned by the DesktopCommanderMCP runtime for filesystem calls that resolve outside the configured working directory
Correlate LLM prompt logs with filesystem tool invocations to identify prompts that request access to symlinked paths

How to Mitigate CVE-2025-11489

Immediate Actions Required

Treat DesktopCommanderMCP path restrictions as guardrails, not as a security boundary, consistent with the maintainer's guidance in Issue #219
Run DesktopCommanderMCP inside a Docker container or equivalent sandbox that enforces real filesystem isolation from the host
Restrict local user accounts that can write into directories exposed to the MCP server

Patch Information

No fix is available. The maintainer has stated that affected versions are no longer supported and that the restriction feature is not intended as a hardened security control. The vendor recommends deploying Desktop Commander with Docker for scenarios where security is a top priority. See the maintainer comment on Issue #219 for the official position.

Workarounds

Deploy DesktopCommanderMCP inside a Docker container with read-only volume mounts scoped to only the directories the LLM needs
Use a dedicated, low-privilege OS user for the MCP runtime and remove that user's write access to directories containing sensitive data
Configure the container or host to disallow following symbolic links using mount options such as nosymfollow where supported
Place sensitive files on separate filesystems that are not mounted into the DesktopCommanderMCP execution environment

bash

# Configuration example: run DesktopCommanderMCP in an isolated container
docker run --rm -it \
  --read-only \
  --tmpfs /tmp \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  -v /srv/mcp-workspace:/workspace:ro,nosymfollow \
  -u 10001:10001 \
  desktopcommandermcp:isolated