CVE-2026-32024

Published: Mar 19, 2026 Last Modified: Mar 19, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,8
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,5
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace boundary. Remote attackers can exploit this by requesting avatar resources through gateway surfaces to disclose local files accessible to the OpenClaw process.

59

Improper Link Resolution Before File Access ('Link Following')

Draft
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control Other
Potential Impacts:
Read Files Or Directories Modify Files Or Directories Bypass Protection Mechanism Execute Unauthorized Code Or Commands
Applicable Platforms
Operating Systems: Windows, Unix
View CWE Details
https://github.com/openclaw/openclaw/commit/3d0337504349954237d09e4d957df5cb844…
https://github.com/openclaw/openclaw/commit/6970c2c2db3ee069ef0fff0ade5cfbdd013…
https://github.com/openclaw/openclaw/security/advisories/GHSA-rx3g-mvc3-qfjf
https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-avatar-handl…