PT-2026-27237 · Openclaw · Openclaw

Tdjackey · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32903

Mitre

CVSS v3.1

6.1

Medium

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

OpenClaw before 2026.3.2 contains a symlink traversal vulnerability in stageSandboxMedia that allows attackers to overwrite files outside the sandbox workspace. Attackers can exploit unvalidated destination paths in media/inbound writes to follow symlinks and overwrite host files beyond intended sandbox boundaries.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-32903

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32903 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c · Note
• https://vulncheck.com/advisories/openclaw-mar-symlink-traversal-in-stagesandboxmedia-destination · Note