[BUG] CRITICAL: Write tool creates files outside working directory on Windows
Resolved 💬 8 comments Opened Jul 30, 2025 by cmyang-cht1 Closed Jan 4, 2026
## 🚨 Critical Security Issue
Problem: Claude Code Write tool created files outside the designated working directory
Environment:
- OS: Windows 11
- Working Directory:
C:\Users\[username]\Projects\MyRepo - Shell: Git Bash (MINGW64)
What Happened:
- Claude was asked to create files in
solutions/project-name/new-component/ - Instead created files in
C:\c\Users\[username]\Projects\MyRepo\solutions\project-name\new-component\ - This created an unauthorized directory structure starting from
C:\c\
Security Impact:
- Claude gained write access to system root directory (C:\)
- Could potentially overwrite system files or create unauthorized directories
- Violates expected sandbox restrictions
Root Cause Analysis:
- Appears to be Git Bash Unix-style path (
/c/Users/...) being incorrectly translated to Windows filesystem - Write tool may be interpreting absolute paths incorrectly on Windows
Reproduction Steps:
- Use Claude Code on Windows with Git Bash environment
- Ask Claude to create multiple files in a project subdirectory
- Use Write tool with absolute path references
- Observe files created in
C:\c\...instead of intended location
Expected Behavior:
- All file operations should be restricted to working directory
- Should error if attempting to write outside sandbox
- Path resolution should be consistent with working directory context
<!-- Add any other context about the problem here, such as screenshots, logs, etc. -->
This issue has 8 comments on GitHub. Read the full discussion on GitHub ↗