PT-2026-27237 · Openclaw · Openclaw

Tdjackey · CVE-2026-32903 · Publicado 2026-03-23 · Atualizado 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description The software contains a symlink traversal issue within the stageSandboxMedia component. This allows attackers to overwrite files outside the designated sandbox workspace. The issue stems from unvalidated destination paths during media inbound writes, enabling exploitation through symlink traversal to overwrite host files beyond the intended sandbox boundaries.

Recommendations Update to version 2026.3.2 or later.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2026-32903

Produtos afetados

Openclaw

Referências · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c · Nota
• https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a · Correção
• https://vulncheck.com/advisories/openclaw-mar-symlink-traversal-in-stagesandboxmedia-destination · Nota
• https://twitter.com/VulmonFeeds/status/2036280689151057932 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32903 · Nota de Segurança