CVE-2026-15317 | A security flaw has been discovered in Sipeed PicoClaw up to… | CVSS 6.3 MEDIUM

Description

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Metadata

CVE ID: CVE-2026-15317
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-09 18:07 UTC
Published: 2026-07-10 00:00 UTC
Last updated: 2026-07-10 00:00 UTC
Primary CWE: CWE-918
Server-Side Request Forgery
Vendor / Product: Sipeed / PicoClaw
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
Sipeed	PicoClaw	—	0.2.0, 0.2.1, 0.2.2, 0.2.3 …

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	Server-Side Request Forgery

CVSS scores (4)

Score	Severity	Version	Source	Vector
7.5	N/D	2.0	cna	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-377257 | Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery https://vuldb.com/vuln/377257
VDB-377257 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/377257/cti
CVE-2026-15317 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-15317
Submit #852877 | Sipeed PicoClaw <= 0.2.9 Server-Side Request Forgery (CWE-918) https://vuldb.com/submit/852877
https://github.com/sipeed/picoclaw/issues/3078
https://github.com/sipeed/picoclaw/