PT-2026-26223 · Openclaw · Openclaw

Tdjackey · Published 2026-03-02 · Updated 2026-03-21 · CVE-2026-27670

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description OpenClaw is affected by a race condition during ZIP file extraction. This allows local attackers to write files to locations outside the intended destination directory. The issue arises from a time-of-check-time-of-use race condition between path validation and file write operations. Attackers can exploit this by manipulating symlinks to redirect file writes outside the designated extraction root.

Recommendations Update OpenClaw to version 2026.3.2 or later.

Fix

Link Following

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-367

Related Identifiers

BDU:2026-05023

CVE-2026-27670

GHSA-R54R-WMMQ-MH84

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-r54r-wmmq-mh84 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/7dac9b05dd9d38dd3929637f26fa356fd8bdd107 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27670 · Security Note
• https://osv.dev/vulnerability/GHSA-r54r-wmmq-mh84 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05023 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27670 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEarity/status/2035247114763346007 · Twitter Post
• https://vulncheck.com/advisories/openclaw-arbitrary-file-write-via-zip-extraction-parent-symlink-race-condition · Note
• https://twitter.com/VulmonFeeds/status/2034516475575234875 · Twitter Post
• https://twitter.com/CVEnew/status/2034520400529416402 · Twitter Post