OpenClaude contains a logic flaw in the permission‑check function that causes the sandbox to return an allow result immediately when the auto‑allow feature is active and no explicit deny rule is set. This early‑exit occurs before the path constraint filter runs, allowing commands that include path traversal sequences such as ../../../../../etc/passwd to bypass directory restrictions. As a result, an attacker who controls the command input can access or execute files outside the intended sandbox boundary. The vulnerability is categorized as CWE‑22 (Path Traversal) and CWE‑284 (Improper Access Control).

Gitlawb's OpenClaude prior to version 0.5.1 is affected. The issue surfaces when the sandbox auto‑allow feature is enabled without an explicit deny rule. Versions 0.5.1 and later contain a patch that addresses the early‑exit logic flaw.

The CVSS score of 8.4 marks this vulnerability as high severity. The EPSS score is less than 1% and it is not listed in the CISA KEV catalog. Exploitation requires local execution of the OpenClaude CLI with the auto‑allow feature enabled and without an explicit deny rule. If the tool is run with elevated privileges or as a service, the impact could extend beyond the current user, potentially affecting the entire system.