PT-2026-26394 · Openclaw · Openclaw

Tdjackey · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-32013

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside the agent workspace. Attackers can exploit symlinked allowlisted files to access arbitrary host files within gateway process permissions, potentially enabling code execution through file overwrite attacks.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-32013

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/125f4071bcbc0de32e769940d07967db47f09d3d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32013 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fgvx-58p6-gjwc · Note
• https://vulncheck.com/advisories/openclaw-symlink-traversal-in-agents-files-methods · Note