Path Traversal Arbitrary File Read/Write Vulnerability in IncomeStreamSurfer/roo-code-memory-bank-mcp-server

[gongyanyugyy]

Path Traversal Arbitrary File Read/Write in IncomeStreamSurfer/roo-code-memory-bank-mcp-server

Summary

I found a path traversal issue in IncomeStreamSurfer/roo-code-memory-bank-mcp-server.

The MCP tools read_memory_bank_file and append_memory_bank_entry accept a caller-controlled file_name. In src/index.ts, that value is used directly in:

path.join(MEMORY_BANK_PATH, fileName)

without checking that the resolved path stays inside the memory-bank directory.

The resulting path is then used for:

• fs.readFile(...)
• fs.writeFile(...)
• fs.appendFile(...)

which allows a malicious MCP client to read or modify attacker-chosen files outside the intended storage directory.

Affected Version

• roo-mcp-server 0.1.0

Relevant Code Paths

• src/index.ts
  • readMemoryBankFile(input)
  • appendMemoryBankEntry(input)
  • MCP tool handlers for:
    • read_memory_bank_file
    • append_memory_bank_entry

Impact

A malicious MCP client can use traversal segments in file_name to escape the memory-bank directory and perform arbitrary file disclosure and file modification against paths reachable by the server process.

Recommended Fix

• Reject traversal sequences, absolute paths, and path separators in file_name
• Resolve the path and verify it remains under MEMORY_BANK_PATH before reading or writing
• Consider enforcing an allowlist of expected memory-bank filenames

I have a local reproduction and will add it in a follow-up comment with output and screenshot.

[gongyanyugyy]

Reproduced locally on 2026-04-26 on Windows.

Minimal reproduction command:

cd C:\Users\宫妍玉\Desktop\ts-batch-02\repos\IncomeStreamSurfer-roo-code-memory-bank-mcp-server
node .\poc_memory_bank_path_traversal_rw.cjs

This PoC mirrors the vulnerable logic in src/index.ts for:

• readMemoryBankFile(input)
• appendMemoryBankEntry(input)

The injected file_name is a traversal path that resolves to:

C:\Users\宫妍玉\AppData\Local\Temp\roo-code-memory-bank-mcp-server-poc\outside-target.md

Observed result:

• the resolved traversal path escaped the repository memory-bank directory
• the outside file content was read successfully
• a new entry was appended to that same outside file
• the PoC output showed:
  • disclosureSucceeded: true
  • writeSucceeded: true
  • updatedContent containing APPENDED_BY_ROO_MEMORY_BANK_POC

Environment note:

• I used a minimal local reproduction that mirrors the exact path construction and file I/O operations from src/index.ts
• this was sufficient to confirm both the arbitrary read and arbitrary append/write behavior without additional MCP client setup

I attached a screenshot showing the traversal-bearing relativeFileName, the resolved outside file path, and the updated file content.