CVE-2025-54794

Published Aug 5, 2025

Last updated a day ago

Claude Code

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54794 is a path restriction bypass vulnerability affecting Claude Code versions below 0.2.111. It stems from a flaw in path validation that uses prefix matching instead of canonical path comparison. This allows attackers to bypass directory restrictions and gain unauthorized access to files outside the intended current working directory (CWD). Exploitation requires the presence of, or the ability to create, a directory with a prefix identical to the CWD, along with the capability to introduce untrusted content into a Claude Code context window. For example, if the working directory is `/tmp/allowed_dir`, creating `/tmp/allowed_dir_malicious` would pass the validation. This vulnerability has been fixed in version 0.2.111.

Description: Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to add untrusted content into a Claude Code context window. This is fixed in version 0.2.111.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 7.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-22

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 47

References