# CVE-2026-7875: Nanoco NanoClaw path traversal and symlink follow in outbox handling

Source: https://junglewise.ai/threats/cve-2026-7875-nanoco-nanoclaw-path-traversal-and-symlink-follow-in-outbox  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-7875 · Severity: high · CVSS 8.8 · Published 2026-05-06

NanoClaw, an AI agent platform, contains a security flaw in how it handles files moving between its internal containers and the host computer. A compromised or malicious AI agent can trick the host system into reading sensitive files or deleting important data outside of its designated workspace. This could lead to the theft of private information or the disruption of the host system's operations.

Technologies: [Nanoco Nanoclaw](https://junglewise.ai/threats/technologies/nanoclaw). Vendors: [Nanoco](https://junglewise.ai/threats/vendors/nanoco).

## Quick answers

**Is CVE-2026-7875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7875 being exploited in the wild.

**How severe is CVE-2026-7875?** High severity, with a CVSS score of 8.8, published 6 May 2026.

**Which products and versions are affected?** Nanoco AI (qwibitai) NanoClaw up to and including 1.2.0.

**Is there a fix for CVE-2026-7875?** A patch was published on 2026-04-30: Fix merged into main branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7875 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-7875?** Check whether you run Nanoco Nanoclaw. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal and symlink following vulnerability exists in NanoClaw's session manager, specifically within the readOutboxFiles() and clearOutbox() functions. The host process trusts container-supplied strings (messages_out.id and content.files) as path components when processing outbound attachments and performing post-delivery cleanup. Because the agent container has write access to its session directory, an attacker can provide crafted path segments or create symlinks to escape the intended outbox directory. This enables arbitrary file reads on the host with the privileges of the NanoClaw process and, in some scenarios, recursive deletion of host-side paths. The vulnerability was addressed by implementing basename-only validation, rejecting symlinks via lstat(), and performing realpath checks to ensure all operations remain confined to the canonical outbox directory.

## Affected products

- Nanoco AI (qwibitai) NanoClaw up to and including 1.2.0

## Timeline

- 2026-04-25: disclosed: Initial pull request for the fix submitted.
- 2026-04-30: patched: Fix merged into main branch.
- 2026-05-06: advisory: CVE-2026-7875 published.

## References

- [https://github.com/qwibitai/nanoclaw/commit/7814e45570edf0024a1a5c2ba9fbc9cb3a49f7f7](https://github.com/qwibitai/nanoclaw/commit/7814e45570edf0024a1a5c2ba9fbc9cb3a49f7f7)
- [https://github.com/qwibitai/nanoclaw/pull/2001](https://github.com/qwibitai/nanoclaw/pull/2001)
- [https://github.com/qwibitai/nanoclaw/releases/tag/v1.2.0](https://github.com/qwibitai/nanoclaw/releases/tag/v1.2.0)