The vulnerability resides in the writeFile function of the ACP ToolBridge Workspace Handler component of nextlevelbuilder’s GoClaw application. The function accepts a file path supplied by a caller and writes data to that path without enforcing directory confinement. Because the input path is not sanitized, an attacker can supply a crafted sequence such as "../../../../etc/passwd" or similar to cause the file system to create or overwrite files that reside outside the intended workspace directory. This nature of the flaw permits the attacker to write arbitrary files, including executable payloads, to arbitrary locations on the host, thereby enabling remote code execution or other destructive actions. The weakness is identified as a classic path traversal flaw (CWE‑22).

The affected system is nextlevelbuilder’s GoClaw application, specifically version 3.13.3‑beta.3. The flaw exists in the Go code located in internal/providers/acp/tool_bridge.go. No other releases or forks are documented to be impacted as of the latest information.

With a CVSS score of 5.3, this issue falls into the medium severity range, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector, as described, can be performed remotely by interacting with the ACP ToolBridge API endpoint that invokes writeFile. An attacker would need to supply a malicious path string in the request payload; if the API is exposed to untrusted clients, the path traversal can be triggered without additional privileges.