PT-2026-26230 · Openclaw · Openclaw

Tdjackey · Published 2026-03-02 · Updated 2026-04-24 · CVE-2026-31990

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description The stageSandboxMedia function does not properly validate destination symlinks during media staging, potentially allowing writes to follow symlinks outside the sandbox workspace. This could allow attackers to overwrite arbitrary files on the host system outside of the sandbox boundaries by placing symlinks in the media/inbound directory. The issue occurs because the function validates source paths but uses a direct copy path for destination files, lacking destination boundary checks.

Recommendations Versions prior to 2026.3.2 should be updated to version 2026.3.2 or later.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2026-05013

CVE-2026-31990

GHSA-2CWR-F5HX-GG3W

GHSA-CFVJ-7RX7-FC7C

Affected Products

Openclaw

References · 14

• https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05013 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31990 · Security Note
• https://osv.dev/vulnerability/GHSA-cfvj-7rx7-fc7c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31990 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2cwr-f5hx-gg3w · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-symlink-traversal-in-stagesandboxmedia-destination · Note
• https://twitter.com/RedPacketSec/status/2034735876010299823 · Twitter Post
• https://twitter.com/CVEnew/status/2034520394208571709 · Twitter Post
• https://twitter.com/CVEarity/status/2034879685369504199 · Twitter Post
• https://twitter.com/ew330952/status/2047502504364020062 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034503677298266483 · Twitter Post