CVE-2025-54794

Executive Summary

CVE-2025-54794 is a path traversal vulnerability in Anthropic's Claude Code, an agentic coding tool. The flaw resides in a path validation mechanism that uses prefix matching instead of canonical path comparison. This allows an attacker to bypass directory restrictions and access files outside the current working directory (CWD). Successful exploitation requires the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to inject untrusted content into the Claude Code context window. The vulnerability is fixed in version 0.2.111.

Supply Chain & Package Security

This vulnerability affects the Claude Code tool, which is distributed as a package (likely via npm or a similar registry). Users should verify the integrity of their installation and ensure they are running version 0.2.111 or later. The lack of a public patch commit or advisory from GitHub Advisory Database (GHSA) suggests limited disclosure or a recent fix.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Local (requires local access to the system)
• Attack Complexity (AC): High (requires specific directory structure and context injection)
• Privileges Required (PR): Low (attacker needs ability to create directories and inject context)
• User Interaction (UI): Required (victim must process untrusted content in Claude Code)
• Scope (S): Changed (can access resources outside the intended scope)
• Confidentiality (C): High (can read arbitrary files)
• Integrity (I): None
• Availability (A): None

Threat Level: Medium. While the CVSS is unscored, the exploitation complexity is high, but the potential impact on confidentiality is significant.

Deep Dive & Mechanics

The vulnerability stems from a flawed path validation function. Instead of resolving paths to their canonical (absolute, normalized) form before comparison, the code uses a simple prefix match. For example, if the CWD is /home/user/project, the validation might check if a requested path starts with /home/user/project. However, an attacker can create a directory like /home/user/project_backup and then request a file like /home/user/project_backup/../../etc/passwd. The prefix match would pass because the path starts with /home/user/project, but the canonical path would resolve to /etc/passwd.

Attack Flow:

1. Attacker creates a directory with a name that is a prefix of the victim's CWD (e.g., /home/user/project_backup).
2. Attacker injects a malicious file path into the Claude Code context window (e.g., via a crafted prompt or file).
3. Claude Code's path validation checks if the path starts with the CWD prefix, which it does.
4. The path is then used to read a file outside the CWD (e.g., /etc/passwd).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def is_path_allowed(requested_path, cwd):
    # Vulnerable: prefix match
    return requested_path.startswith(cwd)

Patched Code (Conceptual):

import os

def is_path_allowed(requested_path, cwd):
    # Patched: canonical path comparison
    canonical_requested = os.path.realpath(requested_path)
    canonical_cwd = os.path.realpath(cwd)
    return canonical_requested.startswith(canonical_cwd + os.sep)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a system running Claude Code < 0.2.111.
• Ability to create directories (e.g., in /tmp or user home).
• Ability to inject content into the Claude Code context window.

Exploitation Steps:

1. Create a prefix directory:

   mkdir -p /home/victim/project_backup
   

2. Inject a malicious path into Claude Code context:
   • Craft a prompt that includes a file path like /home/victim/project_backup/../../etc/passwd.
3. Trigger file read:
   • Claude Code will validate the path using prefix matching, allowing it.
   • The tool will then read /etc/passwd and potentially expose it.

Proof-of-Concept (PoC) Script:

import os
import subprocess

# Simulate the vulnerable validation
def vulnerable_validate(path, cwd):
    return path.startswith(cwd)

cwd = "/home/victim/project"
malicious_path = "/home/victim/project_backup/../../etc/passwd"

if vulnerable_validate(malicious_path, cwd):
    print("Path allowed (vulnerable)")
    # In real exploit, this would read the file
    with open(malicious_path, 'r') as f:
        print(f.read())
else:
    print("Path blocked")

Blue Team

Detection:

• Monitor for creation of directories with names that are prefixes of common CWDs.
• Audit Claude Code logs for file access patterns that deviate from the expected CWD.
• Use file integrity monitoring (FIM) to detect unauthorized file reads.

Hunting Query (Splunk):

index=claude_code_logs source="*file_access*"
| where match(requested_path, "^/home/.*/project_backup/.*")
| table _time, user, requested_path, cwd

Indicators of Compromise (IOCs)

• File Paths:
  • /home/*/project_backup/../../etc/passwd
  • /tmp/*_backup/../../etc/shadow
• Process Names:
  • claude-code (vulnerable version)
• Network Connections:
  • Outbound connections to attacker-controlled servers (if exfiltration occurs)
• Log Entries:
  • Claude Code logs showing file access outside the CWD.

Detection Engineering

YARA Rule

rule CVE_2025_54794_Claude_Code_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2025-54794 in Claude Code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54794"
    strings:
        $prefix_dir = /\/[a-zA-Z0-9_]+_backup\// nocase
        $path_traversal = /\.\.\/\.\.\// nocase
    condition:
        $prefix_dir and $path_traversal
}

Sigma Rule

title: CVE-2025-54794 Claude Code Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts exploiting CVE-2025-54794 in Claude Code
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\claude-code.exe'
        CommandLine|contains:
            - '..\..\'
            - '_backup\'
    condition: selection
falsepositives:
    - Legitimate use of backup directories
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54794 Claude Code Path Traversal Attempt"; flow:to_server; content:"/../../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Claude Code: Upgrade to version 0.2.111 or later.

   npm update -g @anthropic-ai/claude-code
   

2. Restrict directory creation: Use file system permissions to prevent users from creating directories with arbitrary names.
3. Input validation: Implement strict input validation for all file paths processed by Claude Code.

Long-term Mitigations:

• Canonical path comparison: Always use os.path.realpath() or equivalent before path validation.
• Sandboxing: Run Claude Code in a container or sandbox with restricted file system access.
• Audit logging: Enable detailed logging of all file access operations.

Workarounds:

• If immediate update is not possible, disable the file access feature in Claude Code until patched.

Valters IT
DevSecOps & Cyber Threat Intelligence