Executive brief
OpenClaw is a platform used for managing agents and sandboxed environments. A security flaw in its SSH sandbox component allows an attacker to upload a specially crafted archive file that can break out of its restricted area. This could allow an unauthorized user to overwrite critical system files on the host server, potentially leading to a complete system takeover or service disruption.
Technical details
A symlink following vulnerability (CWE-59) exists in OpenClaw's SSH sandbox tar upload mechanism. The application fails to validate whether symlinks within an uploaded TAR archive resolve to locations outside the intended sandbox directory. A remote attacker with low privileges can exploit this by uploading an archive containing malicious symlinks, which are then followed during the extraction or sync process. This allows the attacker to escape the sandbox environment and overwrite arbitrary files on the remote host. The issue is fixed in version 2026.3.31 by rejecting workspace symlinks that resolve outside the uploaded tree.
Affected products
- OpenClaw OpenClaw < 2026.3.31
Timeline
- 2026-03-31: patched: Fix committed and version 2026.3.31 released.
- 2026-03-31: advisory: Vendor advisory GHSA-fv94-qvg8-xqpw published.
- 2026-04-27: disclosed: NVD/VulnCheck disclosure.