CVE-2026-15626

nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversal

CVSS 5.3 MEDIUMCWE-22

Vexday Risk Score

10Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.3EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

14 jul 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3. This affects the function writeFile of the file internal/providers/acp/tool_bridge.go of the component ACP ToolBridge Workspace Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

nextlevelbuilder · GoClaw

Referencias

https://github.com/nextlevelbuilder/goclaw/https://github.com/nextlevelbuilder/goclaw/issues/1201 https://github.com/nextlevelbuilder/goclaw/issues/1201#issuecomment-4760748680 https://vuldb.com/cve/CVE-2026-15626 https://vuldb.com/submit/855805 https://vuldb.com/vuln/378128 https://vuldb.com/vuln/378128/cti