Executive brief
OpenClaw, a package used for managing data synchronization, contains a security flaw in its mirror sync feature. An attacker with low-level access can use specially crafted file links to bypass security restrictions and perform unauthorized actions. This could lead to the exposure of sensitive data or unauthorized modification of files if the feature is enabled.
Technical details
A symlink following vulnerability (CWE-59) exists in OpenClaw's mirror sync feature due to improper resolution of file links before access. The flaw also involves a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367), where the state of a resource changes between the authorization check and the actual file operation. An authenticated attacker with low privileges can exploit remote symlink parents to bypass policy checks and cross authorization boundaries. This allows the attacker to read or write files outside of the intended directory scope. The issue is fixed in version 2026.6.9; users are advised to upgrade or disable the mirror sync feature if it is not required.
Affected products
- OpenClaw OpenClaw < 2026.6.9
Timeline
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date