PT-2026-20906 · Openclaw · Openclaw

Adam55A-Code · Published 2026-02-18 · Updated 2026-02-20 · CVE-2026-27008

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15

Description A flaw exists in the download skill installation process of OpenClaw, specifically before version 2026.2.15. Insufficient validation of targetDir values within skill frontmatter allowed for potential file writing outside the intended installation sandbox during the admin-only skills.install flow. This could occur when the targetDir value was not strictly validated.

Recommendations Update to OpenClaw version 2026.2.15 or later.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-27008

GHSA-H7F7-89MM-PQH6

Affected Products

Openclaw

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27008.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h7f7-89mm-pqh6 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/b6305e97256d67e439719faacf5af3de9727d6e1 · Patch
• https://github.com/openclaw/openclaw/commit/2363e1b0853a028e47f90dcc1066e3e9809d65f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27008 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27008 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h7f7-89mm-pqh6 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.15 · Note
• https://t.me/CVEtracker/45214 · Telegram Post
• https://twitter.com/CVEarity/status/2024843911789990250 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r91qgc/resumen_diario_de_vulnerabilidades_19022026 · Reddit Post