Executive brief
OpenClaw is a popular npm library for managing workspace file operations and enforcing boundaries to keep writes within permitted directories. A flaw in its path validation allows an attacker with authenticated access to bypass the workspace boundary by exploiting symlinks to non-existent targets, enabling file creation outside the intended workspace and potentially exposing or corrupting sensitive data.
Technical details
The vulnerability is a path traversal / symlink bypass (CWE-22, CWE-59) in OpenClaw's workspace boundary validation logic. When a symlink inside the workspace points to a non-existent file outside the workspace, the boundary check incorrectly resolves the alias without fully validating the canonical path, allowing the first write operation to pass validation and create a file outside the workspace. The flaw requires authenticated access (PR:L) and network reachability; it cannot be exploited anonymously. The fix hardens canonical path resolution to evaluate missing-leaf alias paths against true containment rules while preserving legitimate in-workspace symlinks. Patches are available in version 2026.2.26 and later.
Affected products
- OpenClaw openclaw <= 2026.2.25
Timeline
- 2026-03-12: disclosed
- 2026-02-26: patched: Fix committed; patch release 2026.2.26 planned