Path & link handling in AI-generated code

Unsafe path construction, filesystem scope checks, archive extraction, local file access, or symbolic-link handling. 28 published CVEs and GitHub advisories in this category trace back to an AI-assisted code change, across 27 projects.

Findings: 28; 10% of all 284
Projects: 27; Most: openclaw/openclaw (2)
Critical or high: 9; of 20 with a severity score
Latest advisory: Aug 22, 2026; Data through Sep 26, 2026

Search and filter these findings →

Findings per month

May 2025Peak advisory month: Jul 2026Sep 2026

By advisory publication month. The latest month is partial.

AI tools

Which AI tool made the contributing change.

How AI contributed

Whether the AI-assisted change introduced the flaw, widened exposure, or left a fix incomplete.

Languages

Primary language of the affected repository.

All 28 findings

Newest first

Hardening of the FrameNet corpus reader tightened the checks on the names that are interpolated into XML file paths, but a corpus subdirectory can hold a symlink whose name passes those checks and points outside the corpus root, so the reader returns text from a file outside the corpus.
CVE-2026-62384Aug 22, 2026nltk/nltkPythonClaudeFlawed AI-written codePath & link handling
AI-written web server code exposed session log endpoints without authentication, letting unauthenticated users read files via path traversal.
MediumCVE-2026-55156Aug 14, 2026ooples/token-optimizer-mcpJavaScriptClaudeDirect introductionPath & link handling
An AI-assisted dictionary-redaction repair left deeply nested JSON lists behind the recursion cutoff, allowing sensitive-key values to appear unmasked in authorized Variable responses and the UI.
MediumCVE-2026-54183Aug 12, 2026apache/airflowPythonClaudeIncomplete remediationPath & link handling
The AI-written importRiveFile tool passed an unvalidated libraryId into path.join-based manifest writes, enabling arbitrary JSON file writes via path traversal.
CVE-2026-19288Aug 8, 2026astralisone/rive-mcp-server-coreTypeScriptClaudeNew attack surfacePath & link handling
A Claude Opus 4.7 assisted change reverted the earlier human symlink-target check and kept only link-name validation, so the worktree boundary still followed symlinks to their targets.
HighCVE-2026-71556Aug 7, 2026go-git/go-gitGoClaudeFlawed AI-written codePath & link handling
An AI-written option guard for GitPython's Repo.archive() and clone left --add-file, --add-virtual-file and --bundle-uri off its denylists, so caller-supplied keyword options could still read arbitrary local files into an archive or point a clone at an extra bundle.
MediumCVE-2026-73619Aug 3, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationPath & link handling
Human code introduced unsafe local references; a Claude-coauthored remediation still allowed traversal, so crafted schemas could read arbitrary files.
HighCVE-2026-55389Jul 28, 2026koxudaxi/datamodel-code-generatorPythonClaudeFlawed AI-written codePath & link handling
AI-written SanitizeFilePath used a lexical HasPrefix check, letting paths like /packages-extra/evil escape the intended safe directory boundary.
LowCVE-2026-50568Jul 28, 2026fission/fissionGoClaudeNew attack surfacePath & link handling
Claude-assisted path sanitization stopped decoding after eight passes instead of failing closed. A deeply encoded traversal path could survive the check.
HighCVE-2026-59221Jul 24, 2026open-webui/open-webuiPythonClaudeIncomplete remediationPath & link handling
GitHub Copilot co-wrote an incomplete fix that added a raw-string check to IsSafeFileReference, which failed to decode or normalize the reference and so still allowed the bypass that earlier human-written code left open.
MediumGHSA-P5RM-JG5C-8C77Jul 24, 2026microsoft/kiotaC#GitHub CopilotFlawed AI-written codePath & link handling
AI-written code failed to guard against dangling symlinks in Remove/RemoveAll, enabling writes outside the intended scope.
CVE-2026-55668Jul 20, 2026filebrowser/filebrowserGoClaudeFlawed AI-written codePath & link handling
IronClaw's path guard treated a dangling final symbolic link as a missing path inside the sandbox. The repair explicitly rejects that link before allowing a file operation.
LowCVE-2026-16130Jul 18, 2026nearai/ironclawRustClaudeFlawed AI-written codePath & link handling
A Copilot-assisted TypeScript loader read file references without checking where they resolved. A malicious prompt could use an absolute path or traversal to read files available to the host process.
HighCVE-2026-53598Jul 17, 2026microsoft/promptyRustGitHub CopilotFlawed AI-written codePath & link handling
AI-written code concatenated an unsanitized job_id into GitLab API paths, enabling path traversal that lets attackers access arbitrary endpoints with the user's token.
CriticalCVE-2026-61462Jul 13, 2026zereight/gitlab-mcpTypeScriptClaudeNew attack surfacePath & link handling
A change co-authored with Claude introduced matchFileSnapshot, which passed caller-supplied paths to file operations without containment and created the vulnerable behavior.
HighGHSA-322X-V876-G883Jul 2, 2026asymmetric-effort/nogginlessdomTypeScriptClaudeDirect introductionPath & link handling
Claude HUD's AI-written code accepted an unvalidated transcript_path from stdin JSON, enabling arbitrary file reads and leaving permissive cached metadata.
MediumCVE-2026-47091May 18, 2026jarrodwatts/claude-hudTypeScriptClaudeDirect introductionPath & link handling
The GitHub Copilot coding agent copied the existing unguarded directory-entry branch into WriteToDirectory, guarded only file entries, and wrote a new async route that still carried the flaw.
MediumCVE-2026-44788May 8, 2026adamhathcock/sharpcompressC#GitHub CopilotFlawed AI-written codePath & link handling
The Claude Opus 4.7 co-authored change introduced the vulnerable pipeline-file discovery walker and its ciguard.scan_repo caller, which followed symlinks outside the scan root.
CVE-2026-44220May 5, 2026jo-jo98/ciguardPythonClaudeDirect introductionPath & link handling
Claude Code wrote the export service, including the unvalidated job_name that is joined directly into the output file path, introducing the path traversal behavior.
CVE-2026-7589May 1, 2026ghantakiran/splunk-mcp-integrationPythonClaudeDirect introductionPath & link handling
The Claude Code-attributed commit that added logs resource support introduced the unchecked directory and file handling behind the resources read handler.
CVE-2026-7445Apr 30, 2026zachhandley/zmcptoolsTypeScriptClaudeDirect introductionPath & link handling
AI-written code allowed user-supplied message_ids to control directory paths in shutil.rmtree, enabling remote path traversal deletion.
MediumCVE-2026-7386Apr 29, 2026fatbobman/mail-mcp-bridgePythonClaudeDirect introductionPath & link handling
AI-written code exposed an endpoint that accepts any absolute path and returns file contents, enabling remote exfiltration of sensitive host files like /etc/passwd and keys.
CVE-2026-7235Apr 28, 2026erlichliu/claude-agent-sdk-masterTypeScriptClaudeDirect introductionPath & link handling
A Claude Sonnet 4.6 co-authored change tried to harden archive extraction with containment checks, but it validated a rebased absolute symlink target while creating the link with the raw target, so the flaw carried over from earlier human-written code.
MediumCVE-2026-32885Apr 22, 2026ddev/ddevGoClaudeFlawed AI-written codePath & link handling
The AI-attributed change, written with Claude Opus 4.6, introduced the instructionsFilePath read in the local adapters, turning an agent's existing control over its own adapter configuration into a host file read.
GHSA-3PW3-V88X-XJ24Apr 16, 2026paperclipai/paperclipTypeScriptClaudeDirect introductionPath & link handling
A Claude Opus 4.5 co-authored change introduced the workspace check that validated a path string while the filesystem tools read and wrote by path and followed links.
HighCVE-2026-32232Mar 12, 2026qhkm/zeptoclawRustClaudeDirect introductionPath & link handling
AI-written code interpolated untrusted Feishu media keys into temp paths, enabling path traversal and arbitrary file writes outside the temp directory.
MediumCVE-2026-22171Mar 3, 2026openclaw/openclawTypeScriptClaudeDirect introductionPath & link handling
The Claude-attributed Feishu plugin change wrote a media reader that repeated the earlier human-written local-file behavior and still read any local path without an allowed-root check.
HighCVE-2026-26321Feb 17, 2026openclaw/openclawTypeScriptClaudeFlawed AI-written codePath & link handling
AI-written workflow-download code failed to confine caller-controlled filenames to the workflow directory, allowing arbitrary file reads through traversal.
CriticalCVE-2025-55526Aug 26, 2025zie619/n8n-workflowsPythonClaudeDirect introductionPath & link handling