The vulnerability resides in the Import function of the TTS Configuration Endpoint in nextlevelbuilder GoClaw. An attacker can supply a crafted request that causes the server to fetch arbitrary URLs. This elevation of a server‑side request forgery (SSRF) can expose internal hosts or services, leak sensitive data, and potentially allow further exploitation of the upstream systems. The flaw is detectable through the Import endpoint and can be triggered remotely without authentication.

The issue affects nextlevelbuilder GoClaw versions up to 3.11.3, inclusive. All users running these releases without subsequent patches are potentially exposed when using the vulnerable TTS Configuration Endpoint.

The CVSS score of 5.1 indicates a moderate risk. The lack of an EPSS score and absence from the CISA KEV list suggest limited public exploitation activity to date. However, attackers can reach the vulnerable endpoint over the network, and the SSRF flaw is publicly documented, meaning that a determined adversary could leverage existing proof‑of‑concept code to trigger the attack and gain access to internal resources.