CVE-2025-68143: MCP Servers Path Traversal Vulnerability

CVE-2025-68143 Overview

CVE-2025-68143 affects the Model Context Protocol (MCP) Servers reference implementation maintained by the Linux Foundation Projects (lfprojects). The mcp-server-git component prior to version 2025.9.25 shipped a git_init tool that accepted arbitrary filesystem paths without validation. An attacker interacting with the server could initialize a Git repository at any path accessible to the server process. That newly created repository then became a valid target for subsequent Git operations exposed by the same server, expanding the reachable attack surface beyond the intended repository scope. The maintainers removed the git_init tool entirely, as the server is designed to operate on pre-existing repositories only.

Critical Impact
Unauthenticated attackers can convert arbitrary directories reachable by the MCP server into Git repositories, enabling downstream Git tool abuse against locations outside the intended workspace [CWE-22].

Affected Products

mcp-server-git versions prior to 2025.9.25
Model Context Protocol Servers reference implementation (lfprojects)
Any MCP client or agent host exposing the git_init tool from vulnerable versions

Discovery Timeline

2025-12-17 - CVE-2025-68143 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68143

Vulnerability Analysis

The defect lives in the git_init handler of mcp-server-git, part of the MCP Servers reference collection. The tool exposed a repo_path string parameter and invoked Git initialization against that path with no allowlist, canonicalization, or containment check. Unlike other Git tools in the same server, which required the target to already be a valid repository, git_init operated on any writable directory the server process could reach.

Once a directory is initialized as a Git repository, other tools in the same server such as branch, commit, and status handlers accept it as a legitimate target. This chains a path traversal primitive [CWE-22] into broader repository manipulation. The MCP server typically runs with the privileges of the host user, so the blast radius includes home directories, project folders, and any mounted volumes reachable by that user.

Root Cause

The root cause is missing path validation in the GitInit request model and its handler. The model exposed a raw repo_path: str field with no restriction to an approved workspace root. The maintainers concluded that safe validation was not achievable for an init operation on a server intended to work only against existing repositories, so they removed the model and its handler entirely rather than patch the check.

Attack Vector

Exploitation requires an attacker to influence tool calls sent to a vulnerable mcp-server-git instance. In agentic AI deployments this can occur through prompt injection against the model driving the MCP client, a malicious repository containing instructions the agent processes, or a rogue MCP client connected to a shared server. User interaction is required, consistent with typical agentic AI abuse patterns.

python

     repo_path: str
     revision: str
 
-class GitInit(BaseModel):
-    repo_path: str
+
 
 class GitBranch(BaseModel):
     repo_path: str = Field(

Source: GitHub commit eac56e7. The patch removes the GitInit Pydantic model and its associated tool registration from src/git/src/mcp_server_git/server.py, eliminating the unvalidated repo_path entry point.

Detection Methods for CVE-2025-68143

Indicators of Compromise

Unexpected .git directories appearing outside known project workspaces on hosts running MCP servers
MCP server logs recording git_init tool invocations with paths outside an approved workspace root
Newly created .git/config files owned by the user account executing the MCP server process
Subsequent Git tool calls (git_status, git_add, git_commit) targeting directories not previously tracked as repositories

Detection Strategies

Inventory installed mcp-server-git versions across developer workstations and CI hosts, flagging any release earlier than 2025.9.25
Enable verbose logging on MCP servers and alert on git_init calls, which should not occur in patched deployments
Monitor filesystem events for creation of .git directories in unusual locations such as home directories, /tmp, or mounted shares

Monitoring Recommendations

Forward MCP client and server logs to a centralized log platform and correlate tool invocations with the initiating agent session
Baseline the expected set of Git repository paths per host and alert on deviations
Track outbound network activity from processes hosting MCP servers to identify follow-on exfiltration from newly created repositories

How to Mitigate CVE-2025-68143

Immediate Actions Required

Upgrade mcp-server-git to version 2025.9.25 or later on all systems that run the reference MCP Git server
Audit hosts for .git directories created outside sanctioned project locations and remove or quarantine unexpected repositories
Restrict the filesystem scope of the MCP server process using OS-level sandboxing, containers, or dedicated service accounts

Patch Information

The fix is delivered in mcp-server-git2025.9.25. The maintainers removed the git_init tool and the GitInit request model rather than adding path validation, since the server is designed to operate only against existing repositories. Details are published in the GitHub Security Advisory GHSA-5cgr-j3jf-jw3v and the upstream commit eac56e7.

Workarounds

Disable or unregister the git_init tool at the MCP client layer if immediate upgrade is not possible
Run the MCP server inside a container or chroot restricted to the intended repository directory
Configure the MCP host to require explicit user approval for any tool call whose repo_path argument resolves outside the approved workspace root

bash

# Upgrade mcp-server-git to the fixed release
pip install --upgrade 'mcp-server-git>=2025.9.25'

# Verify the installed version
python -m mcp_server_git --version

# Optional: run the server confined to a workspace directory
systemd-run --user --property=ProtectHome=yes \
  --property=ReadWritePaths=/srv/mcp/workspace \
  mcp-server-git --repository /srv/mcp/workspace