A vulnerability in the validate_path function of the write_file component allows a local attacker who can write files to influence the path handling logic so that symbolic links are followed. This can cause the program to access or modify files outside the intended directory, potentially exposing sensitive data or altering unintended files. The weakness is a classic path traversal flaw classified as CWE-59.

The flaw exists in the Nearai Ironclaw tool, affecting all releases up to and including version 0.29.1. Any installation of this tool that includes the write_file component and the path_utils module is potentially vulnerable.

The vulnerability carries a CVSS score of 4.8, indicating moderate severity, and an EPSS score of less than 1 %, meaning publicly observed exploitation is currently rare. The flaw is not listed in the CISA KEV catalog, and local access is required to exploit it. An exploit is publicly available in the source repository and may be used by attackers with local privilege. Applying the patch identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 mitigates the issue.