CVE-2026-48716: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in HKUDS nanobot
nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The WhatsApp bridge downloads media attachments and writes them to disk using a filename derived from the sender's message via documentMessage.fileName, which is concatenated with a prefix and its raw value is passed directly to path.join(mediaDir, outFilename). Node.js path.join resolves .. components, allowing an attacker to escape the intended media/ directory by sending a document with a crafted fileName such as ../../../.ssh/authorized_keys. Because the attacker also controls the file content (the downloaded buffer), this is a write-anywhere primitive — both path and content are attacker-controlled. A fix for this issue is planned for version 0.1.5.post4.
AI Analysis
Technical Summary
The vulnerability exists in the WhatsApp bridge of nanobot (versions 0.1.5.post3 and prior), where the fileName field from incoming WhatsApp document messages is concatenated directly with a media directory path using Node.js path.join without sanitization. Because path.join resolves '..' components, an attacker can craft a fileName such as '../../../.ssh/authorized_keys' to escape the media directory and write arbitrary files anywhere on the filesystem. The attacker controls both the file path and content, enabling a write-anywhere primitive. This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). A fix is planned for version 0.1.5.post4 but no patch is currently available.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to write arbitrary files to any location on the filesystem accessible by the nanobot process. This can lead to arbitrary code execution, privilege escalation, or denial of service. The CVSS 3.1 score is 8.7 (High) with network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, high integrity and availability impact.
Mitigation Recommendations
No official fix or patch is currently available. A fix is planned for version 0.1.5.post4. Until then, users should avoid exposing the WhatsApp bridge to untrusted sources or disable the WhatsApp bridge component if possible. Monitor the vendor advisory for the release of the official patch and apply it promptly once available.
CVE-2026-48716: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in HKUDS nanobot
Description
nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The WhatsApp bridge downloads media attachments and writes them to disk using a filename derived from the sender's message via documentMessage.fileName, which is concatenated with a prefix and its raw value is passed directly to path.join(mediaDir, outFilename). Node.js path.join resolves .. components, allowing an attacker to escape the intended media/ directory by sending a document with a crafted fileName such as ../../../.ssh/authorized_keys. Because the attacker also controls the file content (the downloaded buffer), this is a write-anywhere primitive — both path and content are attacker-controlled. A fix for this issue is planned for version 0.1.5.post4.
CVSS v3.1
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the WhatsApp bridge of nanobot (versions 0.1.5.post3 and prior), where the fileName field from incoming WhatsApp document messages is concatenated directly with a media directory path using Node.js path.join without sanitization. Because path.join resolves '..' components, an attacker can craft a fileName such as '../../../.ssh/authorized_keys' to escape the media directory and write arbitrary files anywhere on the filesystem. The attacker controls both the file path and content, enabling a write-anywhere primitive. This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). A fix is planned for version 0.1.5.post4 but no patch is currently available.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to write arbitrary files to any location on the filesystem accessible by the nanobot process. This can lead to arbitrary code execution, privilege escalation, or denial of service. The CVSS 3.1 score is 8.7 (High) with network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, high integrity and availability impact.
Mitigation Recommendations
No official fix or patch is currently available. A fix is planned for version 0.1.5.post4. Until then, users should avoid exposing the WhatsApp bridge to untrusted sources or disable the WhatsApp bridge component if possible. Monitor the vendor advisory for the release of the official patch and apply it promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-22T18:47:27.755Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a344c3bf198dc38c1709d75
Added to database: 06/18/2026, 19:51:23 UTC
Last enriched: 06/25/2026, 21:15:30 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.