CVE-2026-108839
Received Received - Intake

thClaws Symlink Link-Following Vulnerability

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108839
EUVD
EUVD-2026-97000

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thClaws thClaws 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in thClaws through 0.141.0 allows attackers to exploit a link-following issue in the v1 API POST /v1/inputs endpoint. By planting a symlink under the allowed inputs/ prefix, authenticated uploads can be manipulated to write or truncate files outside the intended workspace with daemon privileges.

Detection Guidance
  • Check thClaws version with: curl -s https://github.com/thClaws/thClaws/releases | grep -i "v0.141.0"
  • Inspect API logs for POST /v1/inputs requests with unusual paths like inputs/link or inputs/../
  • Search for symlinks in workspace directories: find /path/to/workspace -type l -ls
  • Monitor daemon account file writes outside workspace: auditctl -w / -p wa -k unauthorized_writes
  • Review API token usage patterns for unexpected file operations
Impact Analysis

An attacker could overwrite critical system files, corrupt data, or escalate privileges by writing files outside the workspace. This could lead to system instability, unauthorized access, or further compromise of the host.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Update thClaws to the latest version beyond 0.141.0 to patch the vulnerability. Restrict write permissions to the workspace directory and disable symlink following if possible. Monitor file uploads and system logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart