CVE-2026-25724
📋 TL;DR
CVE-2026-25724 is a symbolic link bypass vulnerability in Claude Code that allows reading files explicitly denied in settings.json. Attackers could access sensitive system files like /etc/passwd through symlinks. Users of Claude Code versions before 2.1.7 with deny rules configured are affected.
💻 Affected Systems
- Claude Code
📦 What is this software?
Claude Code by Anthropic
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive system files including password files, SSH keys, configuration files, and other protected data leading to privilege escalation or credential theft.
Likely Case
Unauthorized reading of specific protected files that have symlinks accessible to Claude Code, potentially exposing sensitive application or system configuration data.
If Mitigated
Limited exposure if deny rules are minimal and symlinks to sensitive files are not present in accessible directories.
🎯 Exploit Status
Exploitation requires local access to create or identify symlinks pointing to protected files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.7
Vendor Advisory: https://github.com/anthropics/claude-code/security/advisories/GHSA-4q92-rfm6-2cqx
Restart Required: Yes
Instructions:
1. Update Claude Code to version 2.1.7 or later. 2. Restart Claude Code. 3. Verify deny rules are properly enforced.
🔧 Temporary Workarounds
Remove symbolic links
linuxIdentify and remove symbolic links in directories accessible to Claude Code that point to protected files.
find /path/to/claude/workspace -type l -ls | grep -E "(/etc/passwd|/etc/shadow|other_protected_files)"
rm /path/to/symlink
Restrict file access permissions
linuxUse filesystem permissions to restrict Claude Code's access to sensitive directories.
chmod 700 /etc/passwd
chmod 700 /etc/shadow
🧯 If You Can't Patch
- Disable or remove deny rules from settings.json to eliminate the bypass condition.
- Run Claude Code with minimal privileges and in isolated environments.
🔍 How to Verify
Check if Vulnerable:
Check Claude Code version and test if deny rules are bypassed using symbolic links to protected files.Check Version:
claude-code --versionVerify Fix Applied:
After updating to 2.1.7+, test that accessing protected files through symbolic links now triggers deny rule enforcement.📡 Detection & Monitoring
Log Indicators:
- Failed access attempts to protected files through symbolic links
- Unexpected file read operations from Claude Code process
Network Indicators:
- N/A - local file system vulnerability
SIEM Query:
process_name:"claude-code" AND file_path:"/etc/passwd" OR file_path:"/etc/shadow"