CVE-2026-108839 Details
Description
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.
A link-following vulnerability has been identified in thClaws versions through 0.141.0, specifically in the v1 API POST /v1/inputs endpoint. This vulnerability allows authenticated users to write files outside of the designated workspace by exploiting symlinks. When a symlink is placed under the allowed inputs prefix, it can redirect file uploads to locations outside the workspace, using daemon privileges.
The vulnerability can be fixed by modifying the 'post_inputs' handler to use a symlink-safe path resolution that prevents the write from escaping the workspace. This can be done by integrating the same checks and 'O_NOFOLLOW' safeguards that were applied to the workspace sandbox in a previous update.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thClaws | <v0.141.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |