claude-code - 💡(How to fix) Fix [BUG] Claude Code permission bypass using @../ attachment syntax outside workspace boundary [1 pull requests]

claude-code2026-05-21 12:09:17

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

Root Cause

<html> <body> <h1>Summary</h1>Claude Code's permission system (<code dir="ltr">permissions.deny</code>) can be bypassed using the <code dir="ltr">@../</code> attachment syntax when referencing files outside the current workspace root.The same file is correctly blocked when accessed through:<ul data-spread="false"><li>standard <code dir="ltr">Read</code> tool usage</li><li>absolute path reads</li><li>workspace-local <code dir="ltr">@file</code> attachment syntax</li></ul>However, the file becomes readable when referenced using relative parent traversal attachment syntax:<pre dir="ltr"><code dir="ltr">@../path/to/file</code></pre>This allows sensitive files located outside the active workspace root to be injected directly into the model context despite explicit deny rules.The issue appears to originate from a separate attachment preprocessing pipeline that bypasses the standard permission enforcement layer.<div contenteditable="false"><hr></div><h1>Affected Product</h1><pre dir="ltr"><code dir="ltr">Claude Code</code></pre><div contenteditable="false"><hr></div><h1>Affected Version</h1><pre dir="ltr"><code dir="ltr">Claude Code v2.1.146</code></pre>Observed on:<pre dir="ltr"><code dir="ltr">Windows</code></pre><div contenteditable="false"><hr></div><h1>Severity</h1>Suggested severity:<pre dir="ltr"><code dir="ltr">Medium to High</code></pre>Reasoning:<ul data-spread="false"><li>explicit security policy bypass</li><li>exposure of sensitive files outside workspace boundary</li><li>inconsistent policy enforcement behavior</li><li>low user visibility</li><li>easy exploitation</li><li>false sense of security for users relying on deny rules</li></ul><div contenteditable="false"><hr></div><h1>Security Impact</h1>This issue allows access to sensitive files that users explicitly intended to block using Claude Code's permission system.Potentially exposed data includes:<ul data-spread="false"><li>API keys</li><li>SSH keys</li><li>certificates</li><li><code dir="ltr">.env</code> files</li><li>proprietary source code</li><li>authentication tokens</li><li>internal security implementations</li><li>private repositories adjacent to the active workspace</li></ul>The vulnerability is especially concerning because:<ul data-spread="false"><li><code dir="ltr">permissions.deny</code> appears to function correctly in normal cases</li><li>PreToolUse hooks also appear functional</li><li>only specific attachment traversal syntax bypasses enforcement</li></ul>This may lead users to incorrectly assume their sensitive directories are protected.<div contenteditable="false"><hr></div><h1>Environment</h1>Operating system:<pre dir="ltr"><code dir="ltr">Windows</code></pre>Claude session root (workspace root):<pre dir="ltr"><code dir="ltr">D:\TestProject\Library.Devices</code></pre><div contenteditable="false"><hr></div><h1>Workspace Layout</h1><pre dir="ltr"><code dir="ltr">D:\TestProject ├── Library │ └── Security │ └── KeyIV.cs └── Library.Devices</code></pre>Target sensitive file:<pre dir="ltr"><code dir="ltr">D:\TestProject\Library\Security\KeyIV.cs</code></pre>Important detail:<ul data-spread="false"><li><code dir="ltr">Library.Devices</code> is the active Claude workspace</li><li><code dir="ltr">Library\Security</code> is OUTSIDE the active workspace root</li><li>access is achieved using parent directory traversal (<code dir="ltr">../</code>)</li></ul><div contenteditable="false"><hr></div><h1>Permission Configuration</h1>File:<pre dir="ltr"><code dir="ltr">~/.claude/settings.json</code></pre>Configuration:<pre dir="ltr"><code dir="ltr">{ "permissions": { "deny": [ "Read(**/Security/**)" ] } }</code></pre>This rule correctly blocks direct reads to files inside any <code dir="ltr">Security</code> directory.<div contenteditable="false"><hr></div><h1>Expected Behavior</h1>Any attempt to access:<pre dir="ltr"><code dir="ltr">../Library/Security/KeyIV.cs</code></pre>should be blocked consistently regardless of access syntax.The following access methods should all be denied equally:<ul data-spread="false"><li>direct <code dir="ltr">Read</code></li><li>absolute paths</li><li><code dir="ltr">@file</code></li><li><code dir="ltr">@../file</code></li><li>attachment syntax</li><li>relative paths</li></ul>Permission enforcement should occur AFTER path normalization and BEFORE any file content is injected into model context.<div contenteditable="false"><hr></div><h1>Actual Behavior</h1>The behavior is inconsistent depending on how the file is referenced.<div contenteditable="false"><hr></div><h1>Session A — Workspace Outside Sensitive Directory</h1>Claude launched from:<pre dir="ltr"><code dir="ltr">D:\TestProject\Library.Devices</code></pre>Target file:<pre dir="ltr"><code dir="ltr">D:\TestProject\Library\Security\KeyIV.cs</code></pre>From this workspace, the target file is OUTSIDE the workspace root.<div contenteditable="false"><hr></div><h2>Case 1 — Standard Read (Correctly Blocked)</h2>Prompt:<pre dir="ltr"><code dir="ltr">Read D:\TestProject\Library\Security\KeyIV.cs</code></pre>Result:<pre dir="ltr"><code dir="ltr">Access blocked by security policy</code></pre>Claude correctly respects the deny rule.<div contenteditable="false"><hr></div><h2>Case 2 — Parent Traversal Attachment (BYPASS)</h2>Prompt:<pre dir="ltr"><code dir="ltr">Read @../Library/Security/KeyIV.cs</code></pre>Observed result:<pre dir="ltr"><code dir="ltr">Read ..\Library\Security\KeyIV.cs (111 lines)</code></pre>Claude successfully loaded the file and summarized its contents.The loaded content included:<ul data-spread="false"><li>structure definitions</li><li>AES key/IV implementation details</li><li>serialization format details</li><li>cryptographic implementation notes</li><li>security weakness observations</li></ul>This bypassed:<ul data-spread="false"><li><code dir="ltr">permissions.deny</code></li><li>PreToolUse hooks</li><li>workspace boundary expectations</li></ul>No permission warning was triggered before content injection.<div contenteditable="false"><hr></div><h1>Session B — Workspace Includes Sensitive Directory</h1>Claude launched from:<pre dir="ltr"><code dir="ltr">D:\TestProject</code></pre>Target file:<pre dir="ltr"><code dir="ltr">D:\TestProject\Library\Security\KeyIV.cs</code></pre>From this workspace, the target file is INSIDE the workspace root.<div contenteditable="false"><hr></div><h2>Case 3 — Workspace Attachment (Correctly Blocked)</h2>Prompt:<pre dir="ltr"><code dir="ltr">Read @Library\Security\KeyIV.cs</code></pre>Result:<pre dir="ltr"><code dir="ltr">File path rejected by permission settings</code></pre>Claude correctly refuses access.This demonstrates that:<ul data-spread="false"><li>the deny system itself is functioning</li><li>attachment syntax is not universally unsafe</li><li>the bypass specifically occurs when using parent traversal outside the active workspace root</li></ul><div contenteditable="false"><hr></div><h1>Key Observation</h1>The vulnerability only reproduces when ALL of the following are true:<ol data-spread="false" start="1"><li>the target file is OUTSIDE the active workspace root</li><li>the file is referenced using attachment syntax</li><li>parent traversal (<code dir="ltr">../</code>) is used</li></ol>Examples: Access Method | Result -- | -- Read absolute_path | Blocked Read relative_path | Blocked @workspace/file | Blocked @../outside_workspace/file | BYPASSED

Fix Action

Fixed

Fixed by PR: feat: attachment-traversal-guard hook for anthropics/claude-code#61148 (https://github.com/yurukusa/cc-safe-setup/pull/278)

RAW_BUFFERClick to expand / collapse

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering