Technical impact
The vulnerability allows an attacker with local access to manipulate file operations in the File Tools component of mosaxiv clawlet and achieve link following, a form of improper path handling that can expose or alter files without proper validation. The weakness is a directory traversal / symbolic link following flaw identified as CWE‑59. This flaw does not provide remote code execution or privilege escalation but can lead to unauthorized file access or modification if executed by an insider or an attacker who can execute commands locally.
Affected Systems
mosaxiv clawlet versions up to 0.2.10 are affected. The attack requires local privilege to invoke the read_file, write_file, or edit_file functions exposed by the fs_ops.go file in the File Tools module.
Risk and Exploitability
The CVSS score of 4.8 indicates a moderate impact, and the EPSS score is < 1%, indicating a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring an attacker to run or influence the application on the host. No public exploit has been reported, and the issue was closed as “not planned” by the project maintainers, reducing the immediate threat but still leaving the flaw unpatched in affected versions.
