Description
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.
Published: 2026-10-11
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch
AI Analysis

Impact

A link-following flaw in the POST /v1/inputs endpoint of thClaws allows an attacker who can create a symbolic link under the allowed inputs prefix to cause later authenticated uploads to write or truncate files outside the intended workspace. The vulnerable code follows the symlink, resulting in data being written to arbitrary locations on the filesystem with the privileges of the thClaws daemon.

Affected Systems

The thClaws application, version 0.141.0 and earlier, is affected. Upgrades to versions after 0.141.0 are not known to contain the flaw.

Risk and Exploitability

The vulnerability is rated CVSS 2.3, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need the ability to create a symlink within the working inputs directory and must be authenticated to the POST /v1/inputs endpoint, which is a local, application-level attack vector.

Generated by OpenCVE AI on October 11, 2026 at 15:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade thClaws to a version newer than 0.141.0.
  • Restrict write permissions on the inputs/ directory so that only trusted users can create symlinks.
  • Run the thClaws daemon with the least privilege necessary to limit potential damage from a file write outside the workspace.

Generated by OpenCVE AI on October 11, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Thclaws
Thclaws thclaws
Vendors & Products Thclaws
Thclaws thclaws

Sun, 11 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.
Title thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs
Weaknesses CWE-59
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Thclaws Thclaws
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T11:53:05.751Z

Reserved: 2026-10-11T12:50:50.838Z

Link: CVE-2026-108839

cve-icon Vulnrichment

Updated: 2026-10-18T11:44:38.459Z

cve-icon NVD

Status : Deferred

Published: 2026-10-11T14:17:04.390

Modified: 2026-10-18T12:17:01.393

Link: CVE-2026-108839

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:57:47Z

Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')