Executive brief
OpenClaw is a plugin-based runtime environment that allows users to install custom extensions. A path traversal vulnerability in the plugin installer allows a malicious plugin package to write files outside the intended extensions directory, potentially overwriting configuration files or other critical data in the OpenClaw state directory. Exploitation requires a user to install an attacker-controlled plugin.
Technical details
The vulnerability is a path traversal (CWE-22) in OpenClaw's plugin installation logic. The plugin installer derives the on-disk install directory from the plugin manifest name without proper validation, allowing crafted scoped names (e.g., "@malicious/..") to resolve to parent directories via "../" traversal sequences. On Windows, backslash characters ("\") were also not sanitized, enabling deeper traversal. The attack requires a user to execute `openclaw plugins install` with an attacker-controlled plugin package. An attacker can write files to the OpenClaw state directory (~/.openclaw/ on POSIX systems) rather than the intended extensions subdirectory, potentially overwriting configuration or plugin files. The vulnerability was fixed in openclaw 2026.2.1 by validating plugin IDs and ensuring the resolved install directory remains within the configured extensions base directory.
Affected products
- OpenClaw OpenClaw >=2026.1.20, <2026.2.1
Timeline
- 2026-02-17: disclosed
- 2026-02-17: patched: Fixed in version 2026.2.1
- 2026-02-17: advisory: GHSA-qrq5-wjgg-rvqw published