CVE-2026-108839

Katalog CVE

CVSS 4.2 · Medium EPSS 0,25%

Kerentanan Improper Link Resolution Before File Access ('Link Following'). Skor CVSS 3.1 4.2 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.

Rincian

Terbit di NVD

11 Oktober 2026

Terakhir diubah

11 Oktober 2026

Status NVD

Received

CVSS 3.1

4.2 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/thClaws/thClaws
• https://github.com/thClaws/thClaws/blob/v0.141.0/crates/core/src/api_v1/artifacts.rs#L335-L420
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thclaws-api-inputs-symlink-escape
• https://www.vulncheck.com/advisories/thclaws-through-0.141.0-symlink-following-file-write-via-post-v1-inputs