CVE-2026-25724
Claude Code Has Permission Deny Bypass Through Symbolic Links
In short
Claude Code could read files that users blocked by following symbolic links to those files. This bypassed the security rules meant to restrict file access.
Technical detail
CWE-285 (Improper Authorization) and CWE-61 (UNIX Symbolic Link Following): Claude Code's deny rules in settings.json were not enforced against symbolic link traversal, allowing an agent to access restricted files indirectly. The vulnerability required user configuration of deny rules and the existence of accessible symlinks pointing to denied resources; patched in version 2.1.7.
Summary generated and translated by AI from the official description.
Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code had access to a symbolic link pointing to that file, it was possible for Claude Code to read the restricted file through the symlink without triggering deny rule enforcement. This issue has been patched in version 2.1.7.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
anthropics · claude-codeWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →