CVE-2026-25724 Claude Code Has Permission Deny Bypass Through Symbolic Links

What is CVE-2026-25724?

CVE-2026-25724 is a low-severity vulnerability in anthropics claude-code, published on 6 Feb 2026.

Official description

Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code had access to a symbolic link pointing to that file, it was possible for Claude Code to read the restricted file through the symlink without triggering deny rule enforcement. This issue has been patched in version 2.1.7.

Weakness: CWE-61, CWE-285

Which versions are affected by CVE-2026-25724?

2 open source packages ship an affected version, including @anthropic-ai/claude-code. It affects 1 product.

Products include Anthropic Claude Code.

How do I fix CVE-2026-25724?

Upgrade @anthropic-ai/claude-code to 2.1.7 or later.

Is CVE-2026-25724 being exploited?

There is no known exploitation of CVE-2026-25724 in the wild and no public exploit code.

Other vulnerabilities in anthropics claude-code

• CVE-2025-66032 Claude Code Command Validation Bypass Allows Arbitrary Code Execution High 8.7
• CVE-2025-64755 @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes High 8.7
• CVE-2025-59536 Claude Code's startup trust dialog could lead to Command Execution attack High 8.7
• CVE-2025-58764 Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution High 8.7
• CVE-2025-59041 Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4q92-rfm6-2cqx.