CVE-2026-25722: Anthropic Claude Code Path Traversal Flaw

CVE-2026-25722 Overview

Claude Code is an agentic coding tool developed by Anthropic. Prior to version 2.0.57, a directory traversal vulnerability existed where Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, attackers could bypass write protection mechanisms and create or modify files without user confirmation.

Critical Impact

Successful exploitation allows unauthorized file creation and modification in protected directories, potentially leading to configuration tampering, credential theft, or arbitrary code execution through manipulated configuration files.

Affected Products

• Anthropic Claude Code versions prior to 2.0.57
• Claude Code for Node.js (all platforms)

Discovery Timeline

• 2026-02-06 - CVE-2026-25722 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25722

Vulnerability Analysis

This vulnerability is classified as CWE-20 (Improper Input Validation) and represents a critical flaw in the access control implementation of Claude Code's file system operations. The tool's write protection mechanism was designed to prevent modifications to sensitive directories such as .claude without explicit user confirmation. However, the validation logic failed to account for scenarios where directory navigation commands were chained with write operations.

The attack requires the ability to inject untrusted content into a Claude Code context window, which could occur through various vectors including malicious repository content, compromised project files, or social engineering attacks targeting developers using the tool. Once malicious content is present in the context, an attacker can craft requests that first navigate to a protected directory and then perform write operations that bypass the confirmation prompts.

Root Cause

The root cause lies in the improper validation of directory state during write operations. When the cd command was used to change the working directory, the write protection check did not re-evaluate the current path context before allowing file operations. This created a race condition between directory traversal and the security boundary enforcement, allowing attackers to circumvent the intended access controls.

The validation logic was implemented at the command level rather than at the file system operation level, meaning that sequential commands could exploit the gap between path resolution and permission checks.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must first achieve the ability to influence the content processed by Claude Code, typically through:

1. Crafted repository content containing malicious prompts or instructions
2. Compromised dependencies or project configuration files
3. Social engineering to convince a user to process attacker-controlled content

Once untrusted content is present in the context window, the attacker can instruct the tool to navigate into protected directories using cd commands and subsequently perform write operations. The .claude directory is particularly sensitive as it may contain configuration files, credentials, or other security-relevant data that controls the behavior of the Claude Code tool itself.

The vulnerability mechanism involves chaining directory navigation with write operations in a way that bypasses the confirmation dialog. When the tool evaluates whether a write operation requires user confirmation, it fails to properly account for the current directory state after navigation commands have been executed.

Detection Methods for CVE-2026-25722

Indicators of Compromise

• Unexpected files appearing in .claude or other protected directories
• Modified configuration files in Claude Code installation directories without user action
• Audit logs showing write operations to protected paths following directory navigation commands
• Unusual Claude Code session activity involving sensitive directory access

Detection Strategies

• Monitor file system events for write operations targeting .claude directories and similar protected paths
• Implement application-level logging to track command sequences involving cd followed by file writes
• Review Claude Code audit logs for suspicious patterns of directory traversal combined with file operations
• Use endpoint detection solutions to alert on unauthorized modifications to development tool configurations

Monitoring Recommendations

• Enable verbose logging in Claude Code to capture detailed command execution sequences
• Configure file integrity monitoring (FIM) on sensitive Claude Code directories
• Implement user behavior analytics to detect anomalous patterns in tool usage
• Review context window contents for signs of prompt injection or malicious instructions

How to Mitigate CVE-2026-25722

Immediate Actions Required

• Upgrade Anthropic Claude Code to version 2.0.57 or later immediately
• Audit .claude directories and protected folders for unauthorized modifications
• Review recent Claude Code sessions for signs of exploitation
• Validate the integrity of any configuration files that may have been compromised

Patch Information

Anthropic has released version 2.0.57 of Claude Code which addresses this vulnerability. The patch implements proper path validation at the file system operation level, ensuring that write protection checks are performed based on the actual target path regardless of the current working directory state. Users should update their Claude Code installation immediately.

For detailed information about the security advisory and patch, refer to the GitHub Security Advisory GHSA-66q4-vfjg-2qhh.

Workarounds

• Restrict Claude Code usage to trusted repositories and content sources until patching is complete
• Implement network segmentation to limit exposure of development environments
• Use containerized or sandboxed environments when working with untrusted content
• Manually review and approve all file operations in sensitive directories

# Upgrade Claude Code to patched version
npm update @anthropic-ai/claude-code@2.0.57

# Verify installed version
claude-code --version

# Audit .claude directory for unexpected modifications
ls -la ~/.claude/
git -C ~/.claude status