CVE-2026-16130

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16130", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-17T16:16:09.661Z", "datePublished": "2026-07-18T17:15:10.968Z", "dateUpdated": "2026-07-20T16:54:15.398Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T17:15:10.968Z"}, "title": "nearai ironclaw write_file path_utils.rs validate_path link following", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-59", "lang": "en", "description": "Link Following"}]}], "affected": [{"vendor": "nearai", "product": "ironclaw", "versions": [{"version": "0.29.0", "status": "affected"}, {"version": "0.29.1", "status": "affected"}], "cpes": ["cpe:2.3:a:nearai:ironclaw:*:*:*:*:*:*:*:*"], "modules": ["write_file"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the component write_file. The manipulation leads to link following. Local access is required to approach this attack. The exploit is publicly available and might be used. The identifier of the patch is 369ff3d240cf3c0787b50e1e9f182e1a06c71255. It is recommended to apply a patch to fix this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.4, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.2, "vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-07-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-17T18:21:15.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-x (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/379848", "name": "VDB-379848 | nearai ironclaw write_file path_utils.rs validate_path link following", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/379848/cti", "name": "VDB-379848 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16130", "name": "CVE-2026-16130 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856883", "name": "Submit #856883 | nearai ironclaw 0.29.1 Improper Link Resolution Before File Access (CWE-59)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/nearai/ironclaw/issues/4797", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/nearai/ironclaw/pull/4869", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/nearai/ironclaw/commit/369ff3d240cf3c0787b50e1e9f182e1a06c71255", "tags": ["patch"]}, {"url": "https://github.com/nearai/ironclaw/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T16:54:06.799917Z", "id": "CVE-2026-16130", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T16:54:15.398Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16130", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T16:54:06.799917Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T16:54:11.972Z"}}], "cna": {"tags": ["x_open-source"], "title": "nearai ironclaw write_file path_utils.rs validate_path link following", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-x (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.2, "vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:nearai:ironclaw:*:*:*:*:*:*:*:*"], "vendor": "nearai", "modules": ["write_file"], "product": "ironclaw", "versions": [{"status": "affected", "version": "0.29.0"}, {"status": "affected", "version": "0.29.1"}]}], "timeline": [{"lang": "en", "time": "2026-07-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-17T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-17T18:21:15.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/379848", "name": "VDB-379848 | nearai ironclaw write_file path_utils.rs validate_path link following", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/379848/cti", "name": "VDB-379848 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16130", "name": "CVE-2026-16130 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856883", "name": "Submit #856883 | nearai ironclaw 0.29.1 Improper Link Resolution Before File Access (CWE-59)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/nearai/ironclaw/issues/4797", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/nearai/ironclaw/pull/4869", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/nearai/ironclaw/commit/369ff3d240cf3c0787b50e1e9f182e1a06c71255", "tags": ["patch"]}, {"url": "https://github.com/nearai/ironclaw/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the component write_file. The manipulation leads to link following. Local access is required to approach this attack. The exploit is publicly available and might be used. The identifier of the patch is 369ff3d240cf3c0787b50e1e9f182e1a06c71255. It is recommended to apply a patch to fix this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "Link Following"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T17:15:10.968Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16130", "state": "PUBLISHED", "dateUpdated": "2026-07-20T16:54:15.398Z", "dateReserved": "2026-07-17T16:16:09.661Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-18T17:15:10.968Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:nearai:ironclaw:*:*:*:*:*:*:*:*"], "modules": ["write_file"], "product": "ironclaw", "vendor": "nearai", "versions": [{"status": "affected", "version": "0.29.0"}, {"status": "affected", "version": "0.29.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the component write_file. The manipulation leads to link following. Local access is required to approach this attack. The exploit is publicly available and might be used. The identifier of the patch is 369ff3d240cf3c0787b50e1e9f182e1a06c71255. It is recommended to apply a patch to fix this issue."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en nearai ironclaw hasta la versi\u00f3n 0.29.1. El elemento afectado es la funci\u00f3n validate_path del archivo src/tools/builtin/path_utils.rs del componente write_file. La manipulaci\u00f3n conduce al seguimiento de enlaces. Se requiere acceso local para abordar este ataque. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El identificador del parche es 369ff3d240cf3c0787b50e1e9f182e1a06c71255. Se recomienda aplicar un parche para solucionar este problema."}], "id": "CVE-2026-16130", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 3.2, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16130", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T16:54:06.799917Z", "version": "2.0.3"}}]}, "published": "2026-07-18T18:16:37.430", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/nearai/ironclaw/"}, {"source": "cna@vuldb.com", "url": "https://github.com/nearai/ironclaw/commit/369ff3d240cf3c0787b50e1e9f182e1a06c71255"}, {"source": "cna@vuldb.com", "url": "https://github.com/nearai/ironclaw/issues/4797"}, {"source": "cna@vuldb.com", "url": "https://github.com/nearai/ironclaw/pull/4869"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-16130"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/856883"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/379848"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/379848/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.29.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.29.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ironclaw", "source": "cna", "vendor": "nearai"}, "product": "ironclaw", "vendor": "nearai"}], "created": "2026-07-22T01:00:05.462959+00:00", "updated": "2026-08-01T08:15:03.965497+00:00", "vendors": ["nearai", "nearai$PRODUCT$ironclaw"]}