CVE-2026-32013
OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods
Summary
OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods
Original description
The description as published by the source.
OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside the agent workspace. Attackers can exploit symlinked allowlisted files to access arbitrary host files within gateway process permissions, potentially enabling code execution through file overwrite attacks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com