Path Traversal in Mosaxiv Clawlet File Tools

Executive Summary

CVE-2026-15621 is a vulnerability in the mosaxiv clawlet tool, affecting versions up to 0.2.10. The issue occurs in the file tools component, specifically in the functions read_file, write_file, and edit_file within tools/fs_ops.go.

The vulnerability involves link following, where the tool fails to properly verify whether a resolved file path is a hardlink pointing to a file outside the intended workspace. While the tool checks for path traversal, encoded traversals, absolute paths, and symlinks, it does not detect hardlinks. Hardlinks share the same inode as the original file, allowing an attacker to create a hardlink inside the workspace that points to a sensitive file outside the workspace.

When the tool processes the hardlink path, it treats it as a valid workspace file, enabling the attacker to read, modify, or overwrite the external file. This bypasses the intended workspace isolation, potentially exposing sensitive data or allowing file tampering.

The attack must be performed locally, and the GitHub issue related to this vulnerability was closed with the label 'not planned'.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking for the presence of vulnerable versions of the mosaxiv clawlet tool and verifying if hardlinks are being used to bypass workspace restrictions.

• Identify the installed version of clawlet. If it is version 0.2.10 or earlier, the system is vulnerable. You can check the version using the command: clawlet --version.
• Inspect the workspace directory for hardlinks that may point to files outside the workspace. Use the following command to list hardlinks in a directory: ls -i <workspace_directory> | sort -n. Compare inode numbers to detect hardlinks pointing to the same file.
• Check for suspicious file operations in the workspace. Monitor file access logs or use tools like auditd to track read/write/edit operations on files within the workspace.

Since the vulnerability is local and requires access to the file tools, detection should focus on system audits and version checks rather than network-based scans.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of mosaxiv clawlet (up to 0.2.10):

• Confidentiality Impact: An attacker with access to the file tools can read sensitive files outside the intended workspace by creating hardlinks. This could expose private or confidential data.
• Integrity Impact: The attacker can modify or overwrite files outside the workspace, potentially altering critical system or application files, leading to data corruption or unauthorized changes.
• Availability Impact: If critical files are overwritten or deleted, it could disrupt system operations or cause downtime for applications relying on those files.

The vulnerability requires local access, meaning the attacker must already have some level of access to the system where clawlet is running. However, the impact can be significant due to the potential for unauthorized file access and manipulation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the vulnerability is exploited to access or expose personal data of EU citizens, it could lead to a violation of GDPR. GDPR requires organizations to implement appropriate technical measures to protect personal data. Failure to prevent unauthorized access due to this vulnerability could result in non-compliance, leading to fines or legal action.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), this vulnerability could lead to unauthorized access or modification of PHI. HIPAA mandates strict controls over access to PHI, and exploiting this vulnerability could constitute a breach, resulting in penalties and mandatory reporting.
• Other Standards: Depending on the industry, other compliance frameworks like PCI DSS (for payment card data), SOX (for financial data), or NIST guidelines may also be impacted. Unauthorized access to sensitive data or systems could violate requirements for data protection, access controls, and auditability.

Organizations using affected versions of clawlet should assess their exposure to this vulnerability and take corrective actions to maintain compliance with applicable regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade clawlet to a version beyond 0.2.10 if available. Check the project's GitHub repository for the latest release and update instructions.
• If upgrading is not immediately possible, restrict access to the clawlet tool to trusted users only. Limit permissions to prevent unauthorized users from creating hardlinks or accessing sensitive files.
• Monitor the workspace directory for the creation of hardlinks. Use filesystem monitoring tools to alert on suspicious hardlink creation.
• Review and restrict the workspace directory's permissions to ensure only authorized users can create or modify files within it.
• Consider disabling the file tools (read_file, write_file, edit_file) if they are not essential to your workflow, as these are the components affected by the vulnerability.

Since the GitHub issue was closed with the label 'not planned,' there may not be an official patch. In this case, the above steps are critical to reducing exposure.

Useful 0 Not Useful 0