CVE-2026-15629 describes a link following vulnerability in louisho5 picobot versions 0.1 and 0.2.0. The flaw exists in the CreateSkill/GetSkill function within internal/agent/tools/filesystem.go, part of the Workspace Handler component. An attacker can remotely exploit this weakness by manipulating the function to follow symbolic links, potentially leading to unintended file access or other impacts related to link traversal. The vulnerability was responsibly disclosed but remains unpatched, and a public exploit is available.

The vulnerability enables remote attackers to manipulate the CreateSkill/GetSkill function to follow symbolic links, which may lead to unauthorized access or modification of files outside the intended directory scope. The CVSS 4.0 score of 5.3 (medium severity) reflects the network attack vector with low complexity and no user interaction required, but limited impact on confidentiality, integrity, and availability.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting network access to the affected service and applying any available filesystem access controls to limit the impact of link following. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.