CVE-2026-15621

mosaxiv clawlet File Tools fs_ops.go edit_file link following

State: Published
Severity: 4.8 Medium
Published: Jul 14, 2026
Updated: Jul 14, 2026
Reserved: Jul 13, 2026

Description

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file of the file tools/fs_ops.go of the component File Tools. Performing a manipulation results in link following. The attack needs to be approached locally. The reported GitHub issue was closed with the label "not planned".

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR	VulDB

Weaknesses

CWE-59 Link Following

Affected Products

Product	Versions
clawletmosaxiv	0.2.0Affected 0.2.1Affected 0.2.2Affected 0.2.3Affected 0.2.4Affected 0.2.5Affected 0.2.6Affected 0.2.7Affected 0.2.8Affected 0.2.9Affected 0.2.10Affected

References

VDB-378124 | mosaxiv clawlet File Tools fs_ops.go edit_file link followingvdb-entrytechnical-description
VDB-378124 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-15621 | CVE Analysis and Reportthird-party-advisory
Submit #855796 | mosaxiv clawlet 0.2.10 Improper Link Resolution Before File Access (CWE-59)third-party-advisory
https://github.com/mosaxiv/clawlet/issues/15issue-tracking
https://github.com/mosaxiv/clawlet/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.