PT-2026-57020 · Sipeed · Picoclaw

Eric-D · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-15317

NVD

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-15317

Affected Products

Picoclaw

References · 7

• 🔥 https://github.com/sipeed/picoclaw/issues/3078 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-15317 · Security Note
• https://vuldb.com/vuln/377257 · Note
• https://github.com/sipeed/picoclaw · Note
• https://vuldb.com/submit/852877 · Note
• https://vuldb.com/vuln/377257/cti · Note
• https://vuldb.com/cve/CVE-2026-15317 · Note