OpenClaw has browser trace/download path symlink escape in temp output handling
### Summary Browser trace/download output path handling allowed symlink-root and symlink-parent escapes from the managed temp root. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.2.24` - Affected versions: `<= 2026.2.24` - Planned patched release: `2026.2.25` ### Impact An attacker with relevant local foothold and ability to influence output paths could route writes outside the intended temp root via symlink traversal, leading to arbitrary file overwrite. ### Fix Commit(s) - `496a76c03ba85e15ea715e5a583e498ae04d36e3` ### Release Process Note `patched_versions` is pre-set to the release (`2026.2.25`) so once npm `2026.2.25` is published, the advisory is published. OpenClaw thanks @tdjackey for reporting.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-32054US | high7.8 | — | ||
OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managed… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/496a76c03ba85e15ea715e5a583e498ae04d36e3WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-36h3-7c54-j27rWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-32054ADVISORY
- https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-browser-trace-download-path-handlingWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan