CVE-2026-15629

louisho5 picobot Workspace filesystem.go GetSkill link following

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

Based on the description, it is inferred that a flaw in the CreateSkill and GetSkill functions of Picobot's workspace handler allows an attacker to supply arbitrary URLs that the application will resolve and follow. The weakness identified is path traversal/unsanitized link following (CWE-59). The application may make HTTP or HTTPS requests on behalf of the user, remotely following arbitrary URLs.

Affected Systems

Versions of Picobot released by louisho5 up to and including 0.2.0 contain the vulnerability. Users running 0.2.0 or earlier are at risk until a patched version is installed.

Risk and Exploitability

Based on the description, it is inferred that an attacker can trigger Picobot to follow arbitrary URLs from a remote location. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit could cause Picobot to make outbound HTTP or HTTPS requests on behalf of the user.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Picobot to a version newer than 0.2.0 where the CreateSkill/GetSkill link following flaw has been fixed
  • If an immediate upgrade is not feasible, limit outbound connections from Picobot or implement firewall rules to block unsolicited external HTTP/HTTPS connections
  • Disable or remove the CreateSkill/GetSkill feature if the application configuration allows, or otherwise restrict user input to prevent arbitrary URLs from being processed

Generated by OpenCVE AI on July 31, 2026 at 10:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title louisho5 picobot Workspace filesystem.go GetSkill link following
First Time appeared Louisho5
Louisho5 picobot
Weaknesses CWE-59
CPEs cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*
Vendors & Products Louisho5
Louisho5 picobot
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 12:30 PM
Reserved
Jul 13, 2026, 5:29 PM

View source JSON

Updated
Jul 14, 2026, 12:30 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 5:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 11:00 AM

JSON