PT-2026-26230 · Openclaw · Openclaw

Tdjackey · Publicado 2026-03-02 · Atualizado 2026-04-24 · CVE-2026-31990

Positive Technologies (AI Summary)

CVSS v4.0

7.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description The stageSandboxMedia function does not properly validate destination symlinks during media staging, potentially allowing writes to follow symlinks outside the sandbox workspace. This could allow attackers to overwrite arbitrary files on the host system outside of the sandbox boundaries by placing symlinks in the media/inbound directory. The issue occurs because the function validates source paths but uses a direct copy path for destination files, lacking destination boundary checks.

Recommendations Versions prior to 2026.3.2 should be updated to version 2026.3.2 or later.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2026-05013

CVE-2026-31990

GHSA-2CWR-F5HX-GG3W

GHSA-CFVJ-7RX7-FC7C

Produtos afetados

Openclaw

Referências · 14

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a · Correção
• https://twitter.com/VulmonFeeds/status/2034503677298266483 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-cfvj-7rx7-fc7c · Aviso do Fabricante
• https://twitter.com/ew330952/status/2047502504364020062 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31990 · Nota de Segurança
• https://twitter.com/RedPacketSec/status/2034735876010299823 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-31990 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2cwr-f5hx-gg3w · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2034879685369504199 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-symlink-traversal-in-stagesandboxmedia-destination · Nota
• https://bdu.fstec.ru/vul/2026-05013 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034520394208571709 · Publicação no Twitter