CVE-2026-15626: GoClaw Path Traversal Vulnerability

CVE-2026-15626 Overview

CVE-2026-15626 is a path traversal vulnerability [CWE-22] affecting nextlevelbuilder GoClaw version 3.13.3-beta.3. The flaw resides in the writeFile function within internal/providers/acp/tool_bridge.go, which is part of the ACP ToolBridge Workspace Handler component. Insufficient sanitization of file path input allows authenticated remote attackers to write files outside the intended workspace directory. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse.

Critical Impact
An authenticated remote attacker can traverse the file system through the ACP ToolBridge write handler to create or overwrite files outside the workspace boundary.

Affected Products

nextlevelbuilder GoClaw 3.13.3-beta.3
Component: ACP ToolBridge Workspace Handler
File: internal/providers/acp/tool_bridge.go

Discovery Timeline

2026-07-14 - CVE-2026-15626 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15626

Vulnerability Analysis

The vulnerability exists in the writeFile function inside internal/providers/acp/tool_bridge.go. The ACP ToolBridge Workspace Handler accepts a file path parameter from a remote client and passes it to writeFile without validating that the resolved path stays inside the intended workspace root. An attacker with low-privilege authenticated access can supply relative traversal sequences such as ../ to escape the workspace and write to arbitrary locations on the host filesystem. Successful exploitation compromises confidentiality, integrity, and availability of local files that the GoClaw process can access.

Root Cause

The root cause is missing canonicalization and boundary enforcement on user-supplied file paths in the writeFile handler. The function fails to resolve symbolic components and verify that the final path is a descendant of the workspace directory. This is a classic instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack is network-based and requires low-level authentication with no user interaction. An attacker sends a crafted request to the ACP ToolBridge endpoint containing a filename that includes directory traversal sequences. The handler passes the manipulated path to writeFile, which writes attacker-controlled content to a location outside the workspace, such as configuration files, startup scripts, or other application data.

A verified exploit code example is not available. See the GitHub Issue #1201 and VulDB entry for CVE-2026-15626 for the public disclosure details.

Detection Methods for CVE-2026-15626

Indicators of Compromise

Files created or modified outside the expected GoClaw workspace directory by the GoClaw process user.
Requests to the ACP ToolBridge endpoint containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in filename fields.
Unexpected writes to sensitive paths such as /etc/, user home directories, or application binary locations originating from GoClaw.

Detection Strategies

Inspect application logs for calls to the writeFile function with absolute paths or paths containing parent-directory references.
Deploy filesystem integrity monitoring on directories adjacent to the GoClaw workspace to flag unexpected modifications.
Add web application firewall or reverse proxy rules that reject path traversal patterns in ACP ToolBridge request bodies and query parameters.

Monitoring Recommendations

Enable verbose audit logging on the ACP ToolBridge component to capture requested filenames and their canonicalized resolutions.
Correlate authenticated GoClaw user sessions with write operations to detect low-privilege accounts performing unusual file activity.
Monitor process file descriptors on the GoClaw host for writes outside the configured workspace root.

How to Mitigate CVE-2026-15626

Immediate Actions Required

Restrict network access to the GoClaw ACP ToolBridge endpoint to trusted clients only until a patched build is available.
Run the GoClaw service under a low-privileged, dedicated user account with filesystem write permissions limited to the workspace directory.
Audit existing GoClaw workspaces for unauthorized files that may indicate prior exploitation attempts.

Patch Information

As of the last NVD update on 2026-07-15, no fixed release has been referenced in the CVE record. Track the upstream GoClaw project repository and Issue #1201 for a fix that canonicalizes and validates paths passed to writeFile against the workspace root.

Workarounds

Place the GoClaw process inside a container or chroot with only the workspace directory mounted writable.
Apply mandatory access controls such as AppArmor or SELinux profiles that deny writes outside the intended workspace path.
Add a reverse-proxy filter that rejects ACP ToolBridge requests whose filename fields contain .., absolute paths, or encoded traversal sequences.

bash

# Example AppArmor snippet restricting GoClaw writes to its workspace
/opt/goclaw/bin/goclaw {
  /var/lib/goclaw/workspace/** rw,
  deny /etc/** w,
  deny /root/** w,
  deny /home/** w,
}