CVE-2026-15626 is a path traversal vulnerability affecting nextlevelbuilder GoClaw 3.13.3-beta.3. The issue resides in the writeFile function of the internal/providers/acp/tool_bridge.go file, part of the ACP ToolBridge Workspace Handler component. This vulnerability allows an attacker to remotely manipulate file paths to traverse directories outside the intended workspace, potentially leading to unauthorized file access or modification. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed, but no official patch or fix has been announced by the vendor.

Successful exploitation of this vulnerability could allow a remote attacker to perform path traversal attacks, potentially accessing or modifying files outside the designated directory structure of the application. This may lead to unauthorized disclosure or alteration of data. However, the impact is rated medium with limited confidentiality, integrity, and availability impact as per the CVSS 4.0 vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected service and applying any available compensating controls to limit exposure to untrusted users.