OpenClaw contains a symlink traversal vulnerability
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-43570US | medium6.5 | — | ||
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected re… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c537f3aWEB
- https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538edaeaeWEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-43570ADVISORY
- https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marketplace-repository-path-handlingWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan