EUVD-2026-97000

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-108839

The software thClaws (versions through 0.141.0 ) is vulnerable to a link-following vulnerability (CWE-59) within the post_inputs handler of the v1 API POST /v1/inputs endpoint. An attacker can plant a symlink under the permitted inputs/ prefix, which allows subsequent authenticated uploads to wri...