CVE-2026-108839
LOW
2,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low
Description
AI Translation Available
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.
59
Improper Link Resolution Before File Access ('Link Following')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Other
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Bypass Protection Mechanism
Execute Unauthorized Code Or Commands
Applicable Platforms
Operating Systems:
Windows, Unix
https://github.com/thClaws/thClaws
https://github.com/thClaws/thClaws/blob/v0.141.0/crates/core/src/api_v1/artifac…
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thclaws-api-inputs-symlink-escape
https://www.vulncheck.com/advisories/thclaws-through-0.141.0-symlink-following-…