Path Traversal in GoClaw ACP ToolBridge Workspace

Executive Summary

CVE-2026-15626 is a path traversal vulnerability in nextlevelbuilder GoClaw version 3.13.3-beta.3. It affects the function writeFile in the file internal/providers/acp/tool_bridge.go, specifically within the ACP ToolBridge Workspace Handler component.

The vulnerability arises due to improper handling of dangling symlinks. When an ACP-backed agent creates a symlink inside the workspace pointing to a file outside the intended workspace, the resolvePath() function fails to properly validate the symlink target. Instead of rejecting the path, it falls back to the lexical path, which still appears valid within the workspace. The subsequent os.WriteFile() call then follows the symlink, allowing an attacker to write files outside the intended workspace.

This flaw enables an attacker to bypass workspace boundaries and modify host files outside the ACP workspace, compromising file integrity and breaking sandbox isolation. The vulnerability can be exploited remotely and has been publicly disclosed.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking for signs of path traversal or improper symlink handling in the GoClaw ACP ToolBridge component. Since the vulnerability allows writing files outside the intended workspace via dangling symlinks, you can look for unexpected file modifications or symlinks in the workspace directories.

• Inspect the GoClaw workspace directories for symlinks pointing outside the workspace. Use commands like `ls -la` to list files and identify symlinks, then verify their targets with `readlink -f <symlink>`.
• Check for unexpected file modifications in system directories or outside the workspace. Use file integrity monitoring tools or commands like `find / -mtime -1` to identify recently modified files.
• Review GoClaw logs for unusual activity, such as file write operations to paths outside the workspace. Look for entries related to the `writeFile` function in `internal/providers/acp/tool_bridge.go`.
• Verify the installed version of GoClaw. If it is 3.13.3-beta.3 or earlier, the system is vulnerable. Use the command `goclaw version` or check the binary's version information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of GoClaw (up to 3.13.3-beta.3):

• File integrity compromise: An attacker can modify files outside the intended workspace, potentially altering critical system or application files.
• Sandbox escape: The vulnerability breaks the isolation of the ACP workspace, allowing unauthorized access to the host system.
• Remote exploitation: Since the attack can be carried out remotely, an attacker does not need local access to exploit the vulnerability.
• System security risks: The ability to write arbitrary files can lead to further attacks, such as code execution, privilege escalation, or data exfiltration.

The CVSS v3.1 base score of 6.3 (Medium severity) reflects the potential for low confidentiality, integrity, and availability impacts, with low privileges required and no user interaction needed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access or modification of personal data, it could result in a data breach. GDPR requires organizations to implement appropriate technical measures to protect personal data, and failure to do so could lead to fines or penalties.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), this vulnerability could compromise the integrity and confidentiality of PHI. HIPAA requires safeguards to protect PHI, and a breach could result in non-compliance and penalties.
• Other standards: The vulnerability may also impact compliance with other security standards such as ISO 27001, SOC 2, or NIST frameworks, which require organizations to maintain the integrity and security of their systems and data.

The specific impact on compliance depends on the nature of the data and systems affected, as well as the organization's ability to detect and mitigate the vulnerability in a timely manner.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps to reduce the risk of exploitation.

• Upgrade GoClaw to the latest version where the vulnerability has been patched. Refer to the official repository for the patched release.
• If upgrading is not immediately possible, restrict access to the ACP ToolBridge component. Disable or limit access to the workspace handler for untrusted users or agents.
• Monitor and audit workspace directories for suspicious symlinks or file modifications. Remove any unauthorized symlinks pointing outside the workspace.
• Implement strict file system permissions to limit the ability of the GoClaw process to write to sensitive directories outside the workspace.
• Enable logging and monitoring for file write operations, particularly those involving the `writeFile` function in the ACP ToolBridge component.

Useful 0 Not Useful 0