CVE-2025-61685: Mastra Framework Path Traversal Vulnerability

CVE-2025-61685 Overview

CVE-2025-61685 is a directory traversal vulnerability in Mastra, a TypeScript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 contain a flawed path validation routine that allows attackers to enumerate arbitrary directories on the host filesystem. The framework includes a security check to prevent path traversal during file content reads. However, subsequent logic that generates directory suggestions bypasses this check and returns directory listings. The issue is fixed in version 0.13.20 and tracked as [CWE-548] Information Exposure Through Directory Listing.

Critical Impact
An authenticated attacker can list the contents of arbitrary directories, including the user's home directory, exposing sensitive filesystem structure information.

Affected Products

Mastra framework versions 0.13.8 through 0.13.20-alpha.0
The mcp-docs-server package (packages/mcp-docs-server/src/tools/docs.ts)
Applications embedding vulnerable Mastra releases for AI agent functionality

Discovery Timeline

2025-10-03 - CVE-2025-61685 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61685

Vulnerability Analysis

The vulnerability lives in the documentation tool handler within packages/mcp-docs-server/src/tools/docs.ts. The handler performs two operations when a client requests a documentation path. First, it validates the resolved path against the allowed docsBaseDir to prevent reading files outside the documentation root. Second, if the requested path is not found, it invokes helper logic that enumerates directory contents to suggest alternatives to the caller.

The suggestion path does not reapply the traversal check. As a result, a request containing sequences such as ../../../ bypasses the file-read guard and reaches the directory listing helper, which returns the contents of any directory reachable by the server process. Exploitation requires the attacker to reach the Model Context Protocol (MCP) documentation endpoint but does not require elevated privileges.

Root Cause

The root cause is inconsistent enforcement of a single security boundary. The ReadMdxResult type and its consumers treated "path not found" and "path traversal violation" as equivalent outcomes, so the fallback logic ran even when the input violated the security check. The patch introduces an explicit isSecurityViolation flag on the result type so the suggestion routine can short-circuit on unsafe input.

Attack Vector

An attacker with network access to the Mastra MCP documentation server sends a crafted documentation request containing path traversal sequences. The server rejects the file read, then invokes the directory suggestion logic against the attacker-controlled path. The response reveals the names of files and subdirectories in the targeted location, including sensitive directories such as the user's home directory. The current EPSS score is 0.58% (percentile 46.158).

typescript

// Security patch in packages/mcp-docs-server/src/tools/docs.ts
const docsBaseDir = fromPackageRoot('.docs/raw/');

-type ReadMdxResult = { found: true; content: string } | { found: false };
+type ReadMdxResult =
+  | { found: true; content: string; isSecurityViolation: boolean }
+  | { found: false; isSecurityViolation: boolean };

// Helper function to list contents of a directory
async function listDirContents(dirPath: string): Promise<{ dirs: string[]; files: string[] }> {

Source: GitHub Commit 7f2b528

Detection Methods for CVE-2025-61685

Indicators of Compromise

Requests to Mastra MCP documentation endpoints containing traversal sequences such as ../, ..\, or URL-encoded variants %2e%2e%2f.
Responses from mcp-docs-server that include directory or file names outside the .docs/raw/ tree.
Access log entries referencing sensitive paths such as /home/, /root/, /etc/, or Windows user profile directories.

Detection Strategies

Inspect application logs from Mastra deployments for documentation lookups that resolve outside the intended docs directory.
Deploy web application firewall (WAF) rules that flag path traversal patterns targeting MCP endpoints.
Compare installed Mastra package versions against the vulnerable range 0.13.8 through 0.13.20-alpha.0 in your software bill of materials.

Monitoring Recommendations

Alert on repeated 4xx or empty file responses from the docs tool followed by directory listing payloads.
Correlate outbound requests from AI agents that reference unusual filesystem paths gathered from directory suggestions.
Track version drift for @mastra/* packages across development, staging, and production environments.

How to Mitigate CVE-2025-61685

Immediate Actions Required

Upgrade Mastra to version 0.13.20 or later across all environments running the mcp-docs-server package.
Audit filesystem access logs for the service account running Mastra to identify prior enumeration attempts.
Restrict network exposure of the Mastra MCP documentation endpoint to trusted callers only.

Patch Information

The fix landed in commit 7f2b528ba82db512d68832d2f8ad6cbc8bb46cd4 and shipped in Mastra version 0.13.20. The patch distinguishes between path-not-found and security-violation outcomes so the directory suggestion helper is skipped when input fails the traversal check. Refer to the GitHub Security Advisory GHSA-xh92-rqrq-227v for the vendor advisory.

Workarounds

Run the Mastra process under a dedicated low-privilege user with filesystem access limited to the documentation directory.
Deploy WAF or reverse-proxy rules that reject documentation requests containing .. or encoded traversal sequences.
Disable or firewall the mcp-docs-server endpoint if documentation lookups are not required in production.

bash

# Upgrade Mastra to the patched release
npm install mastra@0.13.20

# Verify installed version
npm ls mastra