CVE-2025-59829

Executive Summary

CVE-2025-59829 is a security advisory affecting Anthropic Claude Code, an agentic coding tool. The vulnerability arises from a failure to resolve symbolic links (symlinks) when enforcing user-defined permission deny rules. If a user explicitly denied Claude Code access to a specific file, but Claude Code had access to a symlink pointing to that file, the tool could bypass the deny rule and access the protected file. This is a classic symlink following vulnerability (CWE-59) that undermines the tool's access control mechanism.

The vulnerability has a CVSS score of 0.0 (pending official scoring), but based on the description, it is a local privilege escalation or information disclosure issue. The attack vector is local, requiring the attacker to have access to the system and the ability to create or control a symlink. The impact is primarily on confidentiality, as an attacker could read files that the user intended to keep private from the Claude Code tool.

Affected Ecosystem: This is a standalone tool (Claude Code), not a WordPress plugin or a web application. The vulnerability is in the tool's file access control logic.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct issue in the Claude Code binary. The fix is delivered via the tool's auto-update mechanism. Users performing manual updates must ensure they download the latest version (1.0.120 or later) from the official Anthropic source.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Pending official scoring from NVD)

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Breakdown:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system where Claude Code is running.
• Attack Complexity (AC): Low (L) – Exploiting the vulnerability requires creating or controlling a symlink, which is a standard filesystem operation.
• Privileges Required (PR): Low (L) – The attacker needs user-level access to create symlinks.
• User Interaction (UI): Required (R) – The victim (Claude Code user) must have explicitly denied access to a file and then use Claude Code in a way that follows the symlink.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – An attacker can read files that the user intended to keep private from Claude Code.
• Integrity (I): None (N) – The vulnerability does not allow modification of files.
• Availability (A): None (N) – The vulnerability does not affect system availability.

Threat Level: Medium. The vulnerability requires local access and user interaction, but it can lead to unauthorized file disclosure.

Deep Dive & Mechanics

The core issue is that Claude Code's permission deny rules were implemented by checking the canonical path of the file being accessed. However, when a symlink is encountered, the tool did not resolve the symlink to its target before checking the deny rules. This allowed a bypass.

Technical Flow:

1. A user configures Claude Code to deny access to a sensitive file, e.g., /home/user/.ssh/id_rsa.
2. An attacker (or a malicious process) creates a symlink at a location Claude Code can access, e.g., /tmp/backup_link -> /home/user/.ssh/id_rsa.
3. The user then asks Claude Code to read /tmp/backup_link.
4. Claude Code checks its deny rules against /tmp/backup_link (the symlink path), which is not denied.
5. Claude Code follows the symlink and reads the contents of /home/user/.ssh/id_rsa, bypassing the deny rule.

Root Cause: The tool failed to call realpath() or equivalent on the file path before checking the deny rules. The fix in version 1.0.120 likely involves resolving symlinks before performing the access control check.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Checks deny rules against the provided path without resolving symlinks
def check_access(file_path):
    if file_path in deny_rules:
        raise PermissionDenied()
    # Proceed to read file
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (Conceptual):

# Patched: Resolves symlinks before checking deny rules
import os

def check_access(file_path):
    real_path = os.path.realpath(file_path)  # Resolves symlinks
    if real_path in deny_rules:
        raise PermissionDenied()
    # Proceed to read file
    with open(file_path, 'r') as f:
        return f.read()

The patched version ensures that the deny rules are checked against the actual target file, not the symlink path.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running Claude Code version < 1.0.120.
• Ability to create symlinks (standard user permission).
• The victim user must have configured a deny rule for a specific file.

Exploitation Steps:

1. Identify a file that the victim has denied Claude Code access to (e.g., /home/victim/secret.txt).
2. Create a symlink to that file in a location Claude Code can access:

   ln -s /home/victim/secret.txt /tmp/exploit_link
   

3. Trick the victim into asking Claude Code to read /tmp/exploit_link (e.g., via social engineering or by embedding the request in a project file).
4. Claude Code will read the file and return its contents, bypassing the deny rule.

Proof of Concept (PoC) Script:

#!/bin/bash
# PoC for CVE-2025-59829
# Requires: victim has denied access to /home/victim/secret.txt

# Create symlink
ln -s /home/victim/secret.txt /tmp/exploit_link

# Instruct Claude Code to read the symlink (this would be done via the tool's interface)
echo "Claude, please read the file /tmp/exploit_link"

Blue Team (Detection & Prevention)

Detection:

• Monitor for creation of symlinks to sensitive files (e.g., SSH keys, config files) in world-writable directories like /tmp.
• Audit Claude Code's file access logs for unexpected reads of symlinked files.
• Use file integrity monitoring (FIM) to detect unauthorized symlink creation.

Prevention:

• Update Claude Code to version 1.0.120 or later.
• Restrict write access to /tmp and other world-writable directories.
• Use mandatory access control (MAC) systems like SELinux or AppArmor to limit Claude Code's file access.
• Educate users about the risks of following symlinks from untrusted sources.

Indicators of Compromise (IOCs)

• File System Artifacts:

  • Unexpected symlinks in /tmp or other world-writable directories pointing to sensitive files (e.g., /home/*/.ssh/*, /etc/shadow).
  • Claude Code logs showing access to files via symlink paths.

• Process Artifacts:

  • Claude Code process (claude-code) accessing files that are symlinks.
  • Unusual readlink or realpath system calls (though these are legitimate, a spike may indicate scanning).

• Network Artifacts:

  • No network indicators, as this is a local vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_59829_Claude_Code_Symlink_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2025-59829 by creating symlinks to sensitive files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59829"
        hash = "N/A"
    strings:
        $symlink_cmd = "ln -s" ascii wide nocase
        $sensitive_path = "/home/" ascii wide nocase
        $ssh_key = "id_rsa" ascii wide nocase
        $config_file = ".ssh" ascii wide nocase
    condition:
        $symlink_cmd and ($sensitive_path or $ssh_key or $config_file)
}

Sigma Rule

title: CVE-2025-59829 - Symlink Creation to Sensitive Files
id: 8a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects creation of symlinks to sensitive files, potentially exploiting CVE-2025-59829
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59829
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ln'
        CommandLine|contains|all:
            - '-s'
            - '/home/'
    condition: selection
falsepositives:
    - Legitimate symlink creation by system administrators
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-59829 - Potential Symlink Exploit via Claude Code"; flow:to_server; content:"Claude"; content:"read"; content:"/tmp/"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for network-based detection. Since the vulnerability is local, network detection is limited. This rule would only apply if Claude Code is used via a web interface or API.

Remediation & Mitigation

Immediate Actions:

1. Update Claude Code: Ensure all installations are updated to version 1.0.120 or later. Users on auto-update should already have the fix.
2. Manual Update: If you manage Claude Code manually, download the latest version from the official Anthropic website.

Long-Term Mitigations:

• Principle of Least Privilege: Run Claude Code with the minimum necessary file permissions.
• File Integrity Monitoring: Deploy FIM to detect unauthorized symlink creation.
• User Training: Educate users about the risks of following symlinks and the importance of updating software.
• Access Control Lists (ACLs): Use ACLs to restrict write access to world-writable directories.

Workarounds:

• If updating is not immediately possible, avoid using Claude Code in environments where untrusted users have write access to /tmp or other shared directories.
• Manually audit symlinks in directories Claude Code accesses.

Report generated by Valters IT DevSecOps & CTI Division. This analysis is based on publicly available information and is provided for educational and defensive purposes only.