Executive brief
OpenClaw is a framework for building AI agents and automating workflows. The stageSandboxMedia function fails to validate symbolic links when staging media files, allowing an attacker with local access to place symlinks in the media/inbound directory that redirect file writes to arbitrary locations outside the sandbox workspace. This could allow an attacker to overwrite critical system files and compromise the host system.
Technical details
The vulnerability is a path traversal / symlink following flaw (CWE-59) in OpenClaw's stageSandboxMedia function. During media staging, the function validates source paths but performs destination writes using a direct copy operation that does not enforce destination boundary or alias checks. When a symlink exists in the destination path (media/inbound), the write operation follows it and overwrites files outside the intended sandbox workspace boundary. Attack requires local access and the ability to place symlinks in the media/inbound directory. The fix, released in version 2026.3.2, routes all staging writes through root-scoped safe write primitives for both local and SCP-staged attachments, preventing destination symlink traversal escapes.
Affected products
- OpenClaw openclaw <= 2026.3.1
Timeline
- 2026-03-03: disclosed: Original advisory published on GitHub
- 2026-03-02: patched: Fix commit 17ede52a4be3034f6ec4b883ac6b81ad0101558a released in version 2026.3.2
- 2026-03-19: advisory: Duplicate advisory (GHSA-2cwr-f5hx-gg3w) withdrawn; primary advisory is GHSA-cfvj-7rx7-fc7c