Executive brief
OpenClaw is an AI automation platform that generates browser traces and download files to temporary directories. An attacker with local system access can exploit improper symlink handling to write files outside the intended temp directory, potentially overwriting critical system or application files and causing data loss or system compromise.
Technical details
OpenClaw's browser trace and download functionality constructs output paths in a managed temp directory but fails to properly validate and resolve symbolic links before performing file writes. An attacker with local access and the ability to influence output paths can create symlinks that resolve to paths outside the intended temp root (via symlink-root or symlink-parent traversal techniques), enabling arbitrary file overwrites on the system. The vulnerability affects all versions up to 2026.2.24 and is rooted in insufficient path canonicalization in the temp path handling code. The fix (released in version 2026.2.25) implements realpath-based write-path checks and secure fallback temp directory validation that fails safely when unsafe symlinks are detected. Exploitation requires local system access and the ability to craft malicious symlinks in predictable locations.
Affected products
- OpenClaw openclaw <= 2026.2.24
Timeline
- 2026-03-02: disclosed
- 2026-02-26: patched: Fix committed; patch released as version 2026.2.25