MCP Server Path Traversal in sublinear-time-solver / consciousness-explorer

Technical Analysis

The export_state/import_state tools (src/consciousness-explorer/mcp/server.js) and saveVectorToFile/loadVectorFromFile tools (src/mcp/server.ts) take an attacker-controlled filepath/file_path parameter and forward it unsanitized to filesystem read/write sinks in index.js. Because there is no canonicalization, allow-listing, or rejection of traversal sequences (e.g., ../), an MCP client can escape the intended working directory and access arbitrary files reachable by the server process's OS-level permissions. This crosses the tool-to-OS trust boundary: the MCP layer treats the tool input as trusted structured data rather than untrusted user input, letting a malicious or compromised agent/client turn a data-processing tool into a general-purpose file read/write primitive. Impact includes credential/secret exfiltration, config tampering, and potential follow-on code execution if writable paths include executable or config files loaded by other processes.

Affected Systems

sublinear-time-solver, consciousness-explorer; protocols: MCP

Detection Signatures

• Log entries showing filepath/file_path parameters containing '../' or absolute paths outside expected working directory
• MCP tool invocations of export_state, import_state, saveVectorToFile, loadVectorFromFile with anomalous or non-relative path values
• Unexpected file writes/reads outside designated data directories by the MCP server process
• File access to sensitive paths (e.g., /etc/passwd, SSH keys, application config) triggered by MCP tool calls

Remediation Steps

1. 1

   Upgrade affected packages

   Update to consciousness-explorer >= 1.1.2 and sublinear-time-solver >= 1.6.0, which contain the fix.

2. 2

   Validate and sandbox file paths

   Implement strict canonicalization and allow-listing of permitted directories for any filepath parameter accepted by MCP tools; reject paths containing traversal sequences or resolving outside the allowed base directory.

3. 3

   Run MCP servers with least privilege

   Execute the MCP server process under a restricted OS account with minimal filesystem permissions to limit blast radius if path validation is bypassed.

4. 4

   Audit and monitor tool invocations

   Log all file-related MCP tool calls with full resolved paths and alert on anomalous or out-of-scope file access.