The read_file MCP tool fails to canonicalize paths before its allowlist check. A model-issued '../' escape exfiltrates SSH keys and .env from the host.
# Reproduction steps redacted under coordinated disclosure. # Full PoC will be published with the advisory at embargo expiry. $ zds reproduce ZDS-2025-0139