Log in Start free

Vulnerability · Published Jun 2, 2026 · Assigned by VulDB

CVE-2026-10583nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery

Medium 4.7

In plain English

A medium-severity server-side request forgery in GoClaw from nextlevelbuilder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.2%top 86.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. Affected by this issue is the function Import of the file internal/http/tts_config.go of the component TTS Configuration Endpoint. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

Affected products (as reported)

VendorProductVersions
nextlevelbuilder GoClaw 3.11.03.11.13.11.23.11.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References