Home

Description

OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managed temp root directory. An attacker with local access can create symlinks to route file writes outside the intended temp directory, enabling arbitrary file overwrite on the affected system.

PUBLISHED Reserved 2026-03-10 | Published 2026-03-21 | Updated 2026-03-21 | Assigner VulnCheck




MEDIUM: 5.9CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

MEDIUM: 6.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Problem types

CWE-59: Improper Link Resolution Before File Access ('Link Following')

Product status

Default status
unaffected

Any version before 2026.2.25
affected

2026.2.25 (semver)
unaffected

Credits

tdjackey reporter

References

github.com/...enclaw/security/advisories/GHSA-36h3-7c54-j27r (GitHub Security Advisory (GHSA-36h3-7c54-j27r)) third-party-advisory

github.com/...ommit/496a76c03ba85e15ea715e5a583e498ae04d36e3 (Patch Commit) patch

www.vulncheck.com/...in-browser-trace-download-path-handling (VulnCheck Advisory: OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling) third-party-advisory

cve.org (CVE-2026-32054)

nvd.nist.gov (CVE-2026-32054)

Download JSON