A vulnerability in the isPathInside function of MiniClaw's executeSkillScript component allows an attacker to traverse filesystem paths. This path traversal can result in unauthorized access to, or execution of, files situated outside the intended directories. The flaw can be triggered remotely by manipulating input passed to the function, potentially leading to information disclosure or compromised system integrity.

The vulnerability appears in 8421bit:MiniClaw across all releases up to the commit identified as 43905b934cf76489ab28e4d17da28ee97970f91f. Due to the project's rolling release strategy, precise affected version ranges are not formally documented, and no fixed release has been specified. All deployments of MiniClaw before the patch commit e8bd4e17e9428260f2161378356affc5ce90d6ed are potentially exposed.

The CVSS score of 5.3 indicates moderate severity, and the exploit is known to be publicly disclosed with remote execution capability. Although the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the lack of mitigation measures combined with the remote exploitability and the nature of path traversal warrants a moderate risk posture. An attacker could manipulate input parameters to gain file system access beyond the intended boundaries if the system's directory permissions are permissive.