Executive brief
OpenClaw is a file and workspace management tool that enforces boundaries to prevent users from writing files outside designated workspace directories. A path traversal vulnerability allows authenticated attackers to bypass these workspace boundaries by exploiting symlinks pointing to non-existent targets outside the workspace, enabling arbitrary file creation on the system.
Technical details
The vulnerability is a path traversal / symlink resolution bypass (CWE-22, CWE-59) in OpenClaw's workspace boundary validation. The root cause is improper alias resolution in the boundary check: when an in-workspace symlink points to a non-existent target outside the workspace, the initial validation incorrectly passes, and the first write operation succeeds in creating files outside the workspace. The attack requires low privilege (authenticated user), network access, and no user interaction. An attacker can achieve arbitrary file write outside the workspace boundary. Versions up to 2026.2.25 are affected; the fix (2026.2.26) hardens canonical path resolution to reject non-existent out-of-root alias targets while preserving valid in-root symlink usage.
Affected products
- OpenClaw OpenClaw <= 2026.2.25
Timeline
- 2026-02-26: disclosed: Advisory GHSA-mgrq-9f93-wpp5 published
- 2026-03-21: other: Duplicate advisory GHSA-9f79-7pw8-3fj8 published
- 2026-03-24: other: Duplicate advisory withdrawn