NanoClaw Container Vulnerability Allows Arbitrary File Access, Recursive Deletion

The National Vulnerability Database has detailed CVE-2026-7875, a critical host/container filesystem boundary vulnerability within NanoClaw. This flaw, rated 8.8 CVSS (High), impacts how NanoClaw handles outbound attachments and outbox cleanup, specifically in messages_out.id and content.files values.

Attackers can exploit this vulnerability to read arbitrary files outside the intended outbox directory by supplying crafted messages or creating symlinked outbox files. The impact isn’t limited to unauthorized reads; a successful exploit can also trigger recursive deletion of paths beyond the designated cleanup target, leading to significant data loss or system disruption.

While specific affected products are not detailed by the National Vulnerability Database, organizations utilizing NanoClaw in containerized environments must understand the severe implications. This isn’t just about data exfiltration; the ability to recursively delete files points to a critical integrity and availability risk that demands immediate attention. It’s a clear path for a compromised container to break out and impact the host system directly.