CVE-2026-15629

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15629", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-13T17:29:56.866Z", "datePublished": "2026-07-14T03:30:09.462Z", "dateUpdated": "2026-07-14T12:30:25.981Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-14T03:30:09.462Z"}, "title": "louisho5 picobot Workspace filesystem.go GetSkill link following", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-59", "lang": "en", "description": "Link Following"}]}], "affected": [{"vendor": "louisho5", "product": "picobot", "versions": [{"version": "0.1", "status": "affected"}, {"version": "0.2.0", "status": "affected"}], "cpes": ["cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*"], "modules": ["Workspace Handler"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-13T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-13T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-13T19:35:03.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-e (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/378131", "name": "VDB-378131 | louisho5 picobot Workspace filesystem.go GetSkill link following", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/378131/cti", "name": "VDB-378131 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15629", "name": "CVE-2026-15629 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/855854", "name": "Submit #855854 | louisho5 picobot 0.2.0 Improper Link Resolution Before File Access (CWE-59)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/louisho5/picobot/issues/40", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/louisho5/picobot/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T12:30:14.532173Z", "id": "CVE-2026-15629", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:30:25.981Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15629", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:30:14.532173Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:30:21.454Z"}}], "cna": {"title": "louisho5 picobot Workspace filesystem.go GetSkill link following", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-e (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*"], "vendor": "louisho5", "modules": ["Workspace Handler"], "product": "picobot", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2.0"}]}], "timeline": [{"lang": "en", "time": "2026-07-13T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-13T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-13T19:35:03.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/378131", "name": "VDB-378131 | louisho5 picobot Workspace filesystem.go GetSkill link following", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/378131/cti", "name": "VDB-378131 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15629", "name": "CVE-2026-15629 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/855854", "name": "Submit #855854 | louisho5 picobot 0.2.0 Improper Link Resolution Before File Access (CWE-59)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/louisho5/picobot/issues/40", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/louisho5/picobot/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "Link Following"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-14T03:30:09.462Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15629", "state": "PUBLISHED", "dateUpdated": "2026-07-14T12:30:25.981Z", "dateReserved": "2026-07-13T17:29:56.866Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-14T03:30:09.462Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*"], "modules": ["Workspace Handler"], "product": "picobot", "vendor": "louisho5", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha identificado una debilidad en louisho5 picobot hasta la versi\u00f3n 0.2.0. La funci\u00f3n afectada es CreateSkill/GetSkill del archivo internal/agent/tools/filesystem.go del componente Workspace Gestor. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar al seguimiento de enlaces. Es posible lanzar el ataque de forma remota. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-15629", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15629", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T12:30:14.532173Z", "version": "2.0.3"}}]}, "published": "2026-07-14T05:16:17.723", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/louisho5/picobot/"}, {"source": "cna@vuldb.com", "url": "https://github.com/louisho5/picobot/issues/40"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-15629"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/855854"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/378131"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/378131/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "picobot", "source": "cna", "vendor": "louisho5"}, "product": "picobot", "vendor": "louisho5"}], "created": "2026-07-14T22:00:18.029314+00:00", "updated": "2026-07-31T11:00:06.437657+00:00", "vendors": ["louisho5", "louisho5$PRODUCT$picobot"]}