CVE-2026-108839

Name of the Vulnerable Software and Affected Versions thClaws versions prior to 0.141.0

Description A link-following issue exists in the post inputs handler of the 'POST /v1/inputs' API endpoint. This flaw allows writes outside the designated workspace by following symbolic links (symlinks), which are files that act as pointers to other files or directories. An attacker who places a symlink under the allowed inputs/ prefix can cause subsequent authenticated uploads to write to or truncate files outside the workspace using daemon privileges.

Recommendations Update thClaws to a version later than 0.141.0. Restrict the use of the 'POST /v1/inputs' API endpoint to minimize the risk of exploitation.