PT-2026-50780 · Hkuds · Nanobot

Gosulashivakumar · Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-48716

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions nanobot versions prior to 0.1.5.post4

Description The WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The bridge downloads media attachments and writes them to disk using a filename derived from the sender's message via documentMessage.fileName, which is concatenated with a prefix and passed directly to the path.join() function. Because Node.js path.join() resolves .. components, an attacker can escape the intended media directory by sending a document with a crafted fileName. Since the attacker also controls the file content, this allows for an arbitrary file write on the system.

Recommendations Update to version 0.1.5.post4.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-48716

Affected Products

Nanobot

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-48716 · Security Note
• https://github.com/HKUDS/nanobot/security/advisories/GHSA-3f63-vcp3-hvqr · Note
• https://twitter.com/CVEnew/status/2067717389647528430 · Twitter Post
• https://twitter.com/infoflowcloud/status/2067718095221796989 · Twitter Post