Executive brief
OpenClaw is a development platform that manages file access within sandboxed environments to prevent unauthorized host system access. A flaw in the temporary directory fallback logic allows attackers to bypass path validation when the fallback directory is a symlink, enabling unauthorized reads of sensitive host files like /etc/passwd outside the intended sandbox boundary.
Technical details
This vulnerability is a path traversal and symlink following bypass (CWE-22, CWE-59) in the sandbox media path resolution. When the primary temporary directory (/tmp/openclaw) is unavailable, resolvePreferredOpenClawTmpDir() falls back to os.tmpdir()/openclaw-<uid> without validating it is a regular directory (not a symlink). The resolveSandboxedMediaSource() function uses lexical containment checks that can be bypassed if the fallback root is a symlink alias pointing outside the sandbox (e.g., to /). An attacker can craft absolute paths like $TMPDIR/openclaw-<uid>/etc/passwd that pass validation and resolve to host files. The fix hardens temp path handling by validating symlink resolution before accepting fallback paths. Patched in version 2026.2.25.
Affected products
- OpenClaw OpenClaw <= 2026.2.24
Timeline
- 2026-02-26: disclosed
- 2026-02-26: patched: Patched in version 2026.2.25
- 2026-03-03: advisory