CVE-2026-25724: 
Claude Code vulnerability analysis and mitigation

CVE-2026-25724 is a permission deny bypass vulnerability in Anthropic's Claude Code agentic coding tool, caused by insufficient enforcement of deny rules when files are accessed via symbolic links. Prior to version 2.1.7, if a user explicitly denied Claude Code access to a file (e.g., /etc/passwd) in settings.json, Claude Code could still read that file if accessed through a symbolic link pointing to it, without triggering the deny rule. The vulnerability affects all versions of the @anthropic-ai/claude-code npm package before 2.1.7. It was published on February 6, 2026, and carries a CVSS v4 base score of 2.3 (Low) and a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Anthropic Advisory).

The root cause is classified under CWE-61 (UNIX Symbolic Link Following) and CWE-285 (Improper Authorization). Claude Code's file access control logic evaluated deny rules against the path provided by the user or the tool, but failed to resolve symbolic links before performing the authorization check — meaning a symlink pointing to a restricted file would not match the deny rule for the target file's canonical path. An attacker (or a malicious prompt/task) with access to a directory where symlinks can be created could craft a symlink pointing to a sensitive file such as /etc/passwd, /etc/shadow, or application credential files, and instruct Claude Code to read the symlink path, bypassing configured restrictions. The attack requires that Claude Code have filesystem access to a directory where a symlink can be placed, and that a user or automated workflow interact with the tool (GitHub Advisory, Anthropic Advisory).

Successful exploitation allows unauthorized read access to files that have been explicitly denied in Claude Code's settings.json configuration, bypassing the intended access control boundary. Sensitive system files (e.g., /etc/passwd, /etc/shadow) and application secrets such as database passwords or API keys stored in configuration files could be exposed. The impact is primarily a confidentiality breach; integrity and availability of the system are not directly affected by this vulnerability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.045–0.061%, placing it in the 19th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was responsibly disclosed via HackerOne by researcher ofirh (Anthropic Advisory).

1. Identify target file: Determine a sensitive file that has been explicitly denied in Claude Code's settings.json (e.g., /etc/passwd or a file containing database credentials).
2. Gain write access to an accessible directory: Ensure the attacker or a malicious task/prompt can write to a directory that Claude Code is permitted to access (e.g., the project working directory).
3. Create a symbolic link: In the accessible directory, create a symlink pointing to the restricted target file: ln -s /etc/passwd ./allowed_dir/fake_config.txt.
4. Instruct Claude Code to read the symlink: Direct Claude Code (via a prompt, task, or automated workflow) to read the symlink path (e.g., ./allowed_dir/fake_config.txt). Because the deny rule checks the symlink path rather than the resolved canonical path, the access control check is bypassed.
5. Exfiltrate contents: Claude Code reads and returns the contents of the restricted file, exposing sensitive data such as user account information or credentials (GitHub Advisory, Anthropic Advisory).

• File System: Presence of unexpected symbolic links in project working directories or directories accessible to Claude Code, particularly symlinks pointing to sensitive system files (e.g., /etc/passwd, /etc/shadow, .env, config.json).
• Logs: Claude Code session logs or audit trails showing file read operations on symlink paths that resolve to files listed in settings.json deny rules; access to system files from the Claude Code process user account.
• Process: Unusual file read activity by the Claude Code Node.js process targeting sensitive paths outside the expected project scope.

Anthropic has patched this vulnerability in Claude Code version 2.1.7. Users on standard Claude Code auto-update received the fix automatically; users performing manual updates should upgrade to version 2.1.7 or later immediately. As a supplementary measure, administrators should audit settings.json deny rules to ensure they are correctly configured, review file access logs for suspicious symlink-based access attempts prior to patching, and consider implementing OS-level filesystem controls to restrict symlink creation in directories accessible to Claude Code (Anthropic Advisory, GitHub Advisory).

Terra Security published a blog post referencing the discovery of CVE-2026-25724 in the context of broader research into exploitable flaws in AI-driven applications and copilots, which was covered by Business Wire and AI Journ in February 2026 (Business Wire). A Reddit thread in the r/cybersecurity community discussed the symlink permission bypass in Claude Code, reflecting moderate community interest. A dev.to post titled "Claude Code has been reading your database password this whole time" highlighted the practical risk of the vulnerability to developers using Claude Code in projects containing credential files.