PT-2026-27225 · Openclaw · Openclaw

Tdjackey · Published 2026-03-03 · Updated 2026-03-24 · CVE-2026-28483

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2 OpenClaw versions 2026.3.1 and earlier

Description A race condition exists in ZIP extraction within OpenClaw that could allow local attackers to write files outside the intended destination directory. This is possible due to a parent-directory symlink rebind occurring between path validation and file write operations. The issue stems from a gap between validation and truncate operations in the src/infra/archive.ts file, allowing manipulation of parent directory symlinks to redirect writes outside the extraction root. The fix involves hardening ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in src/infra/fs-safe.ts and regression coverage in src/infra/archive.test.ts.

Recommendations Update OpenClaw to version 2026.3.2 or later.

Fix

LPE

Link Following

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-367

Related Identifiers

CVE-2026-28483

GHSA-R54R-WMMQ-MH84

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/commit/7dac9b05dd9d38dd3929637f26fa356fd8bdd107 · Patch
• https://osv.dev/vulnerability/GHSA-r54r-wmmq-mh84 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28483 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r54r-wmmq-mh84 · Note
• https://vulncheck.com/advisories/openclaw-mar-arbitrary-file-write-via-zip-extraction-parent-symlink-race-condition · Note
• https://twitter.com/VulmonFeeds/status/2036316526442164384 · Twitter Post