Path Traversal Vulnerability in mcp-server-git by Model Context Protocol

CVE-2025-68145

What is CVE-2025-68145?

A path traversal vulnerability exists in the mcp-server-git when launched with the --repository flag, allowing unauthorized access to other repositories on the server. The issue arises from a failure to validate that paths for subsequent tool calls are restricted to the specified repository. This oversight permits potential operations on unintended repositories. A recent update introduces robust path validation, ensuring that all requested paths align with the permitted repository path. Users are recommended to upgrade to version 2025.12.17 to mitigate this security risk effectively.

References