A path traversal vulnerability in Qwibit NanoClaw allows authenticated local attackers to access restricted files, posing a risk of system-wide data exposure.

This is a path traversal vulnerability (CWE-22) that allows an attacker with low-level access to navigate the filesystem outside of the intended directory. This vulnerability requires authenticated access to the system.

The vulnerability allows for unauthorized access to sensitive files on the host system, which could lead to information disclosure or further privilege escalation. With a CVSS score of 8.8, this represents a significant risk to the integrity and confidentiality of the server environment.

Immediate Action: Update to the version that includes the fix for commit 7814e45570edf0024a1a5c2ba9fbc9cb3a49f7f7.

Proactive Monitoring: Monitor file system access logs for attempts to access directories outside of the application's expected working path.

Compensating Controls: Implement file system permissions (e.g., chroot or restricted user accounts) to limit the damage an authenticated attacker can perform if they successfully exploit this path traversal flaw.

Public Exploit Available: Unknown.

This vulnerability should be treated with high urgency due to the presence of a proof-of-concept. Users of NanoClaw must upgrade to the latest version or apply the upstream fix immediately to mitigate the risk of unauthorized file access.