CVE-2026-25722 in claude-code
Summary
by MITRE • 02/06/2026
Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations to protected folders. By using the cd command to navigate into sensitive directories like .claude, it was possible to bypass write protection and create or modify files without user confirmation. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This issue has been patched in version 2.0.57.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/17/2026
This vulnerability affects Claude Code, an agentic coding tool designed to assist developers in writing and editing code through automated processes. The flaw represents a critical directory traversal and privilege escalation issue that undermines the tool's security controls. Prior to version 2.0.57, the application failed to properly validate directory changes when executing write operations to protected folders, creating a significant security gap in its access control mechanisms.
The technical implementation of this vulnerability stems from inadequate input validation within the command processing system. Specifically, when users executed the cd command to navigate into sensitive directories such as .claude, the application did not properly verify whether the target directory was protected or restricted. This failure allows attackers to bypass write protection mechanisms that should normally prevent unauthorized modifications to sensitive system areas. The vulnerability becomes exploitable when combined with write operations to protected folders, enabling malicious actors to create or modify files without proper user confirmation or authorization.
The operational impact of this vulnerability is substantial as it enables unauthorized file system modifications within protected directories. Attackers who can inject untrusted content into Claude Code's context window can reliably exploit this flaw to gain persistent access to sensitive areas of the file system. This capability undermines the fundamental security model of the application and could potentially allow for the installation of malicious code, modification of configuration files, or creation of backdoors within the user's development environment. The vulnerability particularly affects developers who rely on Claude Code for their coding tasks, as it could compromise their entire development workflow and potentially lead to data exfiltration or system compromise.
The issue has been addressed in version 2.0.57 through enhanced directory validation mechanisms and improved access control enforcement. This patch implements proper validation of directory changes when write operations are performed, ensuring that protected folders cannot be accessed through command injection techniques. Organizations using Claude Code should immediately upgrade to version 2.0.57 or later to remediate this vulnerability. The fix aligns with security best practices outlined in CWE-22 Directory Traversal and CWE-732 Incorrect Permission Assignment for Critical Resource, and addresses tactics described in ATT&CK technique T1059 Command and Scripting Interpreter and T1078 Valid Accounts. Users should also implement additional security measures such as monitoring for suspicious command sequences and restricting the ability to inject untrusted content into the application context to further mitigate potential risks associated with this vulnerability.