OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods
Résumé
OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside the agent workspace. Attackers can exploit symlinked allowlisted files to access arbitrary host files within gateway process permissions, potentially enabling code execution through file overwrite attacks.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com