Executive brief
OpenClaw's Control UI serves static assets and web interface files to users. The component previously validated file paths using string matching but did not properly resolve symbolic links, allowing a local attacker with write access to the Control UI root directory to create a symlink pointing outside the intended directory and read arbitrary files. In untrusted or shared-writable deployments, this could expose sensitive configuration files or other confidential data.
Technical details
The vulnerability exists in src/gateway/control-ui.ts where path.join() combined with string-prefix checks were used to validate asset paths, but the subsequent file-serving APIs follow symbolic links without verifying the resolved path remains within the Control UI root. This allows directory-confinement bypass: an attacker with local filesystem write access to the Control UI assets directory can place a symlink that resolves to a file outside the root (e.g., /etc/passwd or application secrets), and the server will resolve and serve it. The attack requires local access and the ability to write files in the Control UI directory. The fix (commit 7c500ff) enforces realpath containment and verifies file identity before serving assets, preventing symlinks from escaping the intended directory. Patched in version 2026.2.22 and later.
Affected products
- OpenClaw openclaw <=2026.2.21-2
Timeline
- 2026-03-02: disclosed: Advisory published
- 2026-02-21: patched: Security fix committed; patched version 2026.2.22+