PT-2026-26223 · Openclaw · Openclaw

Tdjackey · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-27670

NVD

CVSS v3.1

5.3

Medium

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-27670

Affected Products

Openclaw

References · 6

• https://github.com/openclaw/openclaw/commit/7dac9b05dd9d38dd3929637f26fa356fd8bdd107 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27670 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r54r-wmmq-mh84 · Note
• https://twitter.com/VulmonFeeds/status/2034516475575234875 · Twitter Post
• https://vulncheck.com/advisories/openclaw-arbitrary-file-write-via-zip-extraction-parent-symlink-race-condition · Note
• https://twitter.com/CVEnew/status/2034520400529416402 · Twitter Post