CVE-2026-15626

nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversal

CVSS 5.3 MEDIUMCWE-22

Vexday Risk Score

10Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

14 jul 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3. This affects the function writeFile of the file internal/providers/acp/tool_bridge.go of the component ACP ToolBridge Workspace Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

nextlevelbuilder · GoClaw

Referências

https://github.com/nextlevelbuilder/goclaw/https://github.com/nextlevelbuilder/goclaw/issues/1201 https://github.com/nextlevelbuilder/goclaw/issues/1201#issuecomment-4760748680 https://vuldb.com/cve/CVE-2026-15626 https://vuldb.com/submit/855805 https://vuldb.com/vuln/378128 https://vuldb.com/vuln/378128/cti