This vulnerability in nanocoai NanoClaw up to version 2.0.64 involves a path traversal flaw in the send_file component of the file container/agent-runner/src/mcp-tools/core.ts. Remote attackers can exploit this flaw to manipulate file paths, potentially accessing files outside the intended directory. The issue was reported early to the project, but no vendor response or remediation has been published. The vulnerability has been publicly disclosed, increasing the risk of exploitation, although no known exploits in the wild have been reported.

Successful exploitation of this path traversal vulnerability could allow an attacker to access arbitrary files on the affected system remotely. This could lead to unauthorized disclosure of sensitive information or other impacts depending on the files accessed. The CVSS 4.0 base score of 6.9 indicates a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official nanocoai channels for updates. Until a patch is available, consider restricting network access to the affected component and applying any available compensating controls to limit exposure.