CVE-2025-54794
📋 TL;DR
CVE-2025-54794 is a path traversal vulnerability in Claude Code versions below 0.2.111 that allows attackers to bypass directory restrictions and access files outside the current working directory. This affects users who run untrusted code through Claude Code or allow untrusted content in its context window. The vulnerability stems from improper path validation using prefix matching instead of canonical path comparison.
💻 Affected Systems
- Claude Code
📦 What is this software?
Claude Code by Anthropic
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file read/write, potentially leading to credential theft, data exfiltration, or remote code execution.
Likely Case
Unauthorized access to sensitive files in directories adjacent to the CWD, potentially exposing configuration files, credentials, or source code.
If Mitigated
Limited file access within the same directory tree if proper input validation and sandboxing are implemented.
🎯 Exploit Status
Exploitation requires specific directory structure and ability to inject untrusted content into Claude Code context.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.111
Vendor Advisory: https://github.com/anthropics/claude-code/security/advisories/GHSA-pmw4-pwvc-3hx2
Restart Required: Yes
Instructions:
1. Stop Claude Code service. 2. Update to version 0.2.111 or later using package manager or direct download. 3. Restart Claude Code service.
🔧 Temporary Workarounds
Restrict directory permissions
linuxSet strict permissions on directories outside CWD to prevent unauthorized access
chmod 700 /path/to/sensitive/directories
Sandbox execution
allRun Claude Code in container or VM with restricted filesystem access
docker run --read-only -v /safe/path:/app anthropic/claude-code
🧯 If You Can't Patch
- Disable Claude Code or restrict to trusted users only
- Implement strict input validation and sanitization for all content entering Claude Code context
🔍 How to Verify
Check if Vulnerable:
Check Claude Code version and compare against vulnerable rangeCheck Version:
claude-code --versionVerify Fix Applied:
Verify version is 0.2.111 or higher and test path traversal attempts📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Path traversal attempts in logs
- Access to files outside expected directories
Network Indicators:
- Unexpected outbound file transfers if data exfiltration occurs
SIEM Query:
source="claude-code" AND (event="file_access" AND path NOT STARTSWITH "/expected/path/")