Executive brief
OpenClaw is an AI platform that executes tasks across operating systems. A time-of-check/time-of-use vulnerability in its sandbox media handling allows an attacker to read files outside the intended sandbox boundary through symlink manipulation. This could expose sensitive host files that the sandbox is designed to protect from access.
Technical details
This is a TOCTOU (time-of-check/time-of-use) race condition combined with symlink following (CWE-367, CWE-59). The vulnerable code validates media file paths during a check phase, but performs the actual file read through a separate code path at a later time. An attacker can manipulate symlinks between these two phases to redirect reads outside sandboxRoot. The vulnerability affects media attachment and image flows in versions up to 2026.2.26. The fix consolidates path validation and file operations into a single root-scoped, boundary-safe read operation that eliminates the check/use drift. No network access appears required; exploitation likely requires local interaction or control over media inputs.
Affected products
- OpenClaw openclaw <= 2026.2.26
Timeline
- 2026-03-02: disclosed
- 2026-03-01: patched: Patched in version 2026.3.1