# CVE-2026-15627: nextlevelbuilder GoClaw local file disclosure in browser tool

Source: https://junglewise.ai/threats/cve-2026-15627-nextlevelbuilder-goclaw-local-file-disclosure-in-browser-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-15627 · Severity: medium · CVSS 4.3 · Published 2026-07-14

GoClaw, a tool for deploying AI agent teams, contains a security flaw in its browser automation component. An authorized user could trick the system into opening local files on the server instead of web pages. This allows the user to read sensitive information from the server's hard drive, such as configuration files, logs, or security tokens, which they should not be able to access.

Technologies: [Nextlevelbuilder GoClaw](https://junglewise.ai/threats/technologies/goclaw). Vendors: [Nextlevelbuilder](https://junglewise.ai/threats/vendors/nextlevelbuilder).

## Quick answers

**Is CVE-2026-15627 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15627 being exploited in the wild.

**How severe is CVE-2026-15627?** Medium severity, with a CVSS score of 4.3, published 14 July 2026.

**Which products and versions are affected?** Nextlevelbuilder GoClaw up to 3.13.3-beta.3.

**Is there a fix for CVE-2026-15627?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15627 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15627?** Check whether you run Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in GoClaw up to version 3.13.3-beta.3 within the `handleNavigate` function of `pkg/browser/tool.go`. The application fails to validate the URI scheme of the `args.targetUrl` parameter before passing it to the underlying browser automation library (Rod). A remote authenticated attacker with 'operator' privileges can provide a `file://` URL to force the browser to load local system files. By subsequently using the `snapshot` or `act.evaluate` actions, the attacker can retrieve the contents of any file readable by the OS user running the GoClaw process. As of the advisory date, no patch is available.

## Affected products

- nextlevelbuilder GoClaw up to 3.13.3-beta.3

## Timeline

- 2026-07-14: advisory: NVD publication date

## References

- [https://github.com/nextlevelbuilder/goclaw/](https://github.com/nextlevelbuilder/goclaw/)
- [https://github.com/nextlevelbuilder/goclaw/issues/1207](https://github.com/nextlevelbuilder/goclaw/issues/1207)
- [https://github.com/nextlevelbuilder/goclaw/issues/1207](https://github.com/nextlevelbuilder/goclaw/issues/1207)
- [https://vuldb.com/cve/CVE-2026-15627](https://vuldb.com/cve/CVE-2026-15627)
- [https://vuldb.com/submit/855847](https://vuldb.com/submit/855847)
- [https://vuldb.com/vuln/378129](https://vuldb.com/vuln/378129)
- [https://vuldb.com/vuln/378129/cti](https://vuldb.com/vuln/378129/cti)

## Related threats

- [nextlevelbuilder GoClaw Information Disclosure in jq Handler](https://junglewise.ai/threats/cve-2026-18038-nextlevelbuilder-goclaw-information-disclosure-in-jq-handler)
- [nextlevelbuilder GoClaw authorization bypass in ExecTool.Execute](https://junglewise.ai/threats/cve-2026-16199-nextlevelbuilder-goclaw-authorization-bypass-in-exectool-execute)
- [nextlevelbuilder GoClaw SSRF in web_fetch component](https://junglewise.ai/threats/cve-2026-16124-nextlevelbuilder-goclaw-ssrf-in-web-fetch-component)
- [nextlevelbuilder GoClaw authorization bypass in ToolsInvokeHandler](https://junglewise.ai/threats/cve-2026-16123-nextlevelbuilder-goclaw-authorization-bypass-in)
- [nextlevelbuilder GoClaw authorization bypass in exec approval flow](https://junglewise.ai/threats/cve-2026-16122-nextlevelbuilder-goclaw-authorization-bypass-in-exec-approval)