[BUG] CRITICAL: Write tool creates files outside working directory on Windows

Resolved 💬 8 comments Opened Jul 30, 2025 by cmyang-cht1 Closed Jan 4, 2026

## 🚨 Critical Security Issue

Problem: Claude Code Write tool created files outside the designated working directory

Environment:

  • OS: Windows 11
  • Working Directory: C:\Users\[username]\Projects\MyRepo
  • Shell: Git Bash (MINGW64)

What Happened:

  • Claude was asked to create files in solutions/project-name/new-component/
  • Instead created files in C:\c\Users\[username]\Projects\MyRepo\solutions\project-name\new-component\
  • This created an unauthorized directory structure starting from C:\c\

Security Impact:

  • Claude gained write access to system root directory (C:\)
  • Could potentially overwrite system files or create unauthorized directories
  • Violates expected sandbox restrictions

Root Cause Analysis:

  • Appears to be Git Bash Unix-style path (/c/Users/...) being incorrectly translated to Windows filesystem
  • Write tool may be interpreting absolute paths incorrectly on Windows

Reproduction Steps:

  1. Use Claude Code on Windows with Git Bash environment
  2. Ask Claude to create multiple files in a project subdirectory
  3. Use Write tool with absolute path references
  4. Observe files created in C:\c\... instead of intended location

Expected Behavior:

  • All file operations should be restricted to working directory
  • Should error if attempting to write outside sandbox
  • Path resolution should be consistent with working directory context

<!-- Add any other context about the problem here, such as screenshots, logs, etc. -->

View original on GitHub ↗

This issue has 8 comments on GitHub. Read the full discussion on GitHub ↗