PT-2026-35768 · Openclaw · Openclaw

Jufeng123768 · Published 2026-04-07 · Updated 2026-05-01 · CVE-2026-41383

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.2

Description An arbitrary directory deletion issue exists in mirror mode. Attackers can delete remote directories by influencing the remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. By manipulating these OpenShell config paths, attackers can cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data.

Recommendations Update to version 2026.4.2.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41383

GHSA-M34Q-H93W-VG5X

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/b21c9840c2e38f4bb338d031511b479d5f07ca25 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-m34q-h93w-vg5x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41383 · Security Note
• https://osv.dev/vulnerability/GHSA-m34q-h93w-vg5x · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/161767 · Telegram Post
• https://vulncheck.com/advisories/openclaw-arbitrary-remote-directory-deletion-via-mis-scoped-mirror-mode-paths · Note
• https://twitter.com/CVEnew/status/2049227537230839997 · Twitter Post