Executive brief
OpenClaw is an AI agent orchestration platform that includes SSH sandbox functionality for secure file transfers. The SSH sandbox tar upload feature fails to validate symlinks before extracting uploaded files, allowing authenticated attackers to escape the sandbox directory and write arbitrary files on the remote host. This could enable attackers to corrupt configurations, inject malicious code, or compromise system integrity.
Technical details
The vulnerability is a CWE-59 symlink following flaw in OpenClaw's SSH sandbox tar upload handler. When processing uploaded tar archives, the code does not validate or reject symlinks that resolve outside the intended upload directory before extraction. An authenticated attacker with SSH access can craft a malicious tar file containing symbolic links pointing to sensitive paths outside the sandbox, allowing arbitrary file writes to the remote host. The vulnerability requires authentication and network access to the SSH service. A fix was implemented in commit 3d5af14 on 2026-03-31 and released in version 2026.3.31, which now rejects workspace symlinks that resolve outside the uploaded tree before syncing to the remote sandbox.
Affected products
- openclaw openclaw <=2026.3.28
Timeline
- 2026-03-31: disclosed
- 2026-03-31: patched