# CVE-2026-48716: HKUDS nanobot path traversal in WhatsApp bridge

Source: https://junglewise.ai/threats/cve-2026-48716-hkuds-nanobot-path-traversal-in-whatsapp-bridge  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-48716 · Severity: high · CVSS 8.7 · Published 2026-06-18

nanobot is a personal AI assistant that can integrate with messaging platforms like WhatsApp. A security flaw in its WhatsApp bridge allows an attacker to send a specially crafted document that forces the assistant to write files to any location on the host computer's storage. This could allow an attacker to gain full control over the system by overwriting sensitive files like security keys or configuration settings without any user interaction.

Technologies: [HKUDS Nanobot](https://junglewise.ai/threats/technologies/nanobot). Vendors: [HKUDS](https://junglewise.ai/threats/vendors/hkuds).

## Quick answers

**Is CVE-2026-48716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48716 being exploited in the wild.

**How severe is CVE-2026-48716?** High severity, with a CVSS score of 8.7, published 18 June 2026.

**Which products and versions are affected?** HKUDS Nanobot <= 0.1.5.post3.

**Is there a fix for CVE-2026-48716?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48716 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48716?** Check whether you run HKUDS Nanobot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in `bridge/src/whatsapp.ts` within nanobot versions up to 0.1.5.post3. The application fails to sanitize the `fileName` field from incoming WhatsApp document messages before passing it to `path.join()`. Because `path.join()` resolves `..` sequences, an attacker can provide a filename like `../../../../.ssh/authorized_keys` to escape the intended media directory. Since the attacker also controls the file content, this provides a 'write-anywhere' primitive. This can lead to Remote Code Execution (RCE) by overwriting SSH keys, crontabs, or configuration files. A fix is planned for version 0.1.5.post4.

## Affected products

- HKUDS nanobot <= 0.1.5.post3

## Timeline

- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/HKUDS/nanobot/security/advisories/GHSA-3f63-vcp3-hvqr](https://github.com/HKUDS/nanobot/security/advisories/GHSA-3f63-vcp3-hvqr)

## Related threats

- [HKUDS nanobot server-side request forgery in WebFetchTool](https://junglewise.ai/threats/cve-2026-92576-hkuds-nanobot-server-side-request-forgery-in-webfetchtool)
- [HKUDS nanobot argument injection in shell command execution](https://junglewise.ai/threats/cve-2026-90809-hkuds-nanobot-argument-injection-in-shell-command-execution)
- [HKUDS nanobot incomplete blacklist in shell command execution](https://junglewise.ai/threats/cve-2026-90808-hkuds-nanobot-incomplete-blacklist-in-shell-command-execution)
- [HKUDS Nanobot denial of service in Matrix media download handler](https://junglewise.ai/threats/cve-2026-49140-hkuds-nanobot-denial-of-service-in-matrix-media-download-handler)
- [HKUDS Nanobot SSRF and token disclosure in Microsoft Teams channel](https://junglewise.ai/threats/cve-2026-49139-hkuds-nanobot-ssrf-and-token-disclosure-in-microsoft-teams)