EUVD-2026-43618
GHSA-3w4p-rmf6-8x3x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires low-privilege auth (PR:L); symlink traversal yields limited file read/write with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Link-following vulnerability in louisho5 picobot up to version 0.2.0 allows a remote, low-privileged attacker to traverse outside the intended workspace directory via the CreateSkill and GetSkill functions in the filesystem handler. The root cause is improper symlink resolution (CWE-59) in internal/agent/tools/filesystem.go, enabling potential unauthorized file read and write operations on the host filesystem. A public exploit exists as a GitHub issue report; no vendor patch has been released and the project maintainer has not yet responded to the disclosure.
Technical ContextAI
picobot (cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*) is a small agent-based automation tool hosted on GitHub under the louisho5 account. The affected code resides in internal/agent/tools/filesystem.go within the Workspace Handler component, specifically in the CreateSkill and GetSkill functions that manage skill artifacts on the filesystem. CWE-59 (Improper Link Resolution Before File Access, 'Link Following') describes a class of vulnerability where an application follows symbolic links without verifying the link target remains within an authorized directory boundary. In this context, an attacker who can supply crafted input to the CreateSkill or GetSkill API paths can construct a symlink payload that causes the server to resolve file operations outside the intended workspace sandbox, exposing arbitrary host filesystem paths for reading or writing.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the disclosure as of the report date. As an immediate compensating control, administrators should restrict network access to the picobot service to trusted, authenticated users only, reducing exposure given the PR:L requirement. Deploying picobot within a container or chroot jail with a read-only filesystem mount outside the designated workspace directory would prevent symlink traversal from reaching sensitive host paths - this is the most actionable mitigation given the symlink-following nature of CWE-59. Additionally, audit any existing skill definitions for symlink artifacts that reference paths outside expected workspace boundaries. Monitor the project repository at https://github.com/louisho5/picobot/ and the VulDB advisory at https://vuldb.com/vuln/378131 for patch releases. If the tool is non-essential, consider disabling it entirely until a fix is available.
Server-side request forgery in louisho5 picobot up to version 0.2.0 allows authenticated remote attackers to manipulate
OS command injection in louisho5 picobot up to version 0.2.0 allows local low-privileged attackers to execute arbitrary
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today