CVE-2025-59829: anthropic claude code

csirt@kutim:~/threat-intel/cve/CVE-2025-59829

CVSS 6.5 · Medium EPSS 0,45%

Kerentanan UNIX Symbolic Link (Symlink) Following pada anthropic claude code. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.120.

Rincian

Terbit di NVD: 3 Oktober 2025
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-61: UNIX Symbolic Link (Symlink) Following
EPSS (30 hari): 0,45% peluang dieksploitasi; lebih tinggi dari 37,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
anthropic	claude code	Semua versi sebelum 1.0.120

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/anthropics/claude-code/security/advisories/GHSA-66m2-gx93-v996 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 12:28 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.