Description

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-10-11T14:17:04.390Z",
  "pubdate": "2026-10-11T14:17:04.390Z",
  "executiveSummary": "The thClaws product (versions 0.141.0 and earlier) contains a critical link-following vulnerability within the v1 API endpoint '/v1/inputs'.\nThis vulnerability is classified as an arbitrary file write or truncation issue resulting from improper handling of symbolic links during file operations.\nAn authenticated attacker can manipulate the system to write data to unauthorized locations outside the intended workspace, potentially escalating privileges or causing system-wide data corruption.\nThe flaw exists within the 'post_inputs' handler, which fails to perform adequate validation or sanitization when processing file paths that traverse or interact with symlinks.\nSuccessful exploitation allows an attacker to overwrite sensitive configuration files or system binaries, provided the attacker can plant a symlink within the designated 'inputs/' prefix.\nBecause the service operates with daemon-level privileges, any unauthorized write operation inherits these permissions, posing a significant risk to the integrity and confidentiality of the host operating system.\nThis vulnerability requires authenticated access, but once authenticated, the attacker does not need further specialized permissions to conduct the attack, provided they can influence the file system layout within the allowed input path.",
  "technicalDetails": "The vulnerability resides in the 'post_inputs' handler of the 'thClaws' v1 API, specifically within the logic processing the 'POST /v1/inputs' endpoint.\nThe root cause is a failure in the application's file I/O abstraction layer to resolve and validate paths against the intended workspace boundaries when encountering symbolic links.\nUnder normal operating conditions, the application expects files to be stored within a specific 'inputs/' directory. However, the handler fails to resolve the canonical path of the target destination after symbolic link dereferencing.\nAn attacker can exploit this by first creating a symbolic link at a location within the 'inputs/' path that points to a sensitive file elsewhere on the host filesystem (e.g., '/etc/shadow' or a configuration file).\nWhen a subsequent authorized upload request is processed by the 'post_inputs' handler, the daemon inadvertently follows the malicious symlink rather than restricting the write operation to the legitimate workspace.\nBecause the 'thClaws' service executes with daemon privileges, the kernel performs the file write or truncation as the service user, thereby bypassing standard user-level permissions that would otherwise prevent modification of system-critical files.\nThe attack flow proceeds as follows: 1) The attacker gains authenticated access to the API. 2) The attacker uploads or otherwise ensures a symlink exists under the 'inputs/' prefix pointing to a target file outside the workspace. 3) The attacker initiates a POST request to '/v1/inputs' directed at the location of the symlink. 4) The application, lacking proper link-following restrictions, writes the provided input payload into the target file, resulting in file truncation or unauthorized content injection.\nThis vulnerability represents a significant breach of isolation primitives. The exploitation does not require memory corruption but leverages a logic error in path traversal management. The post-exploitation impact includes persistent code execution, arbitrary file deletion, or denial of service through configuration destruction, depending on the target file selected by the attacker."
}