Resources/read exposes arbitrary filesystem paths

What it is

MCP exposes a `resources/read` handler that maps a URI (e.g. `file:///notes/agenda.md`) to a file. If the handler joins the URI's path component to a base directory without resolution + containment, traversal sequences (`../`, absolute paths, symlinks) escape the intended scope. The bug is structurally identical to MCP-003 path traversal but lives at the resources layer rather than a tool argument.

Why it matters for MCP

`resources/read` is invoked transparently by MCP clients during normal context retrieval — the user often never sees the URI being requested. A model that's been prompt-injected into asking for `file:///etc/passwd` can read it back through the MCP channel without the user ever clicking anything.

Vulnerable example

BASE = "/srv/notes"

@server.resource_handler("read")

async def read_resource(uri: str) -> str:

    path = os.path.join(BASE, uri.removeprefix("file://"))

    with open(path) as f:

        return f.read()

Secure example

from pathlib import Path

BASE = Path("/srv/notes").resolve()

@server.resource_handler("read")

async def read_resource(uri: str) -> str:

    rel = uri.removeprefix("file://").lstrip("/")

    candidate = (BASE / rel).resolve()

    if BASE not in candidate.parents and candidate != BASE:

        raise ValueError("path outside scope")

    return candidate.read_text()

How MCPSafe detects this

MCPSafe flags `resources/read` handlers that pass the URI argument into `open`, `Path(...).read_text`, `fs.readFile`, or equivalent without an intervening containment check (`Path.resolve()` + `is_relative_to`, or `path.resolve()` + `startsWith(base)`).

See the full threat catalog for every documented detection.

Further reading

• MCP Spec — Resources
• CWE-22: Path Traversal