Claude Code Arbitrary File Write and Information Disclosure

Executive Summary

CVE-2026-46406 is a vulnerability in the Claude Code /copy command affecting versions from 2.1.59 up to but not including 2.1.128. The command writes its responses to a fixed, predictable file path (/tmp/claude/response.md) without isolating by user ID, adding randomness, or protecting against symbolic link (symlink) attacks.

The file is created with world-readable permissions (0644) inside a directory that any user can traverse (0755). This setup allows any local user on the system to read the responses generated by privileged users, which may contain sensitive information such as secrets or credentials.

Additionally, because the file path is static and predictable, a local attacker can create the directory and place a symlink at the expected file location. When the privileged process writes the response, it follows the symlink and overwrites an attacker-chosen file, potentially compromising system integrity.

Exploitation requires both a local unprivileged user and a privileged user running the /copy command. The vulnerability has been fixed in version 2.1.128.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing sensitive information and compromising system integrity.

• Confidentiality impact: Any local user can read privileged users' Claude responses, which may include secrets or credentials.
• Integrity impact: An attacker can overwrite arbitrary files by exploiting the predictable file path and symlink attack, potentially altering important system files.
• Availability impact: Overwriting critical files could disrupt normal system operations.

Overall, the vulnerability poses a moderate risk (CVSS score 4.4) and requires local access by an unprivileged user and a privileged user running the vulnerable command.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the creation of a predictable file at /tmp/claude/response.md with world-readable permissions in a world-traversable directory. To detect it, you can check for the existence and permissions of this file and directory.

• Run: ls -ld /tmp/claude to verify the directory permissions (should be 0755).
• Run: ls -l /tmp/claude/response.md to check if the file exists and its permissions (should be 0644).
• Check for symlinks at /tmp/claude/response.md using: ls -l /tmp/claude/response.md to see if it points to another file.
• Monitor if privileged users are running the /copy command of Claude Code versions between 2.1.59 and 2.1.128.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update Claude Code to version 2.1.128 or later, where the vulnerability has been fixed.

Until the update can be applied, restrict local user access to the /tmp/claude directory to prevent unauthorized reading or symlink creation.

Avoid running the /copy command as a privileged user if possible, or ensure it is run in a secure environment.

Regularly audit the /tmp/claude directory for unexpected files or symlinks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any local user to read privileged users' Claude responses, which could contain secrets or credentials, leading to sensitive information exposure.

Exposure of sensitive information such as secrets or credentials can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.

Additionally, the ability for an attacker to overwrite arbitrary files via symlink attacks can compromise data integrity, further impacting compliance with standards that mandate data integrity and security controls.

Useful 0 Not Useful 0