CVE-2026-43570
MEDIUM
6,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
AI Translation Available
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.
61
UNIX Symbolic Link (Symlink) Following
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Applicable Platforms
All platforms may be affected
https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c5…
https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538e…
https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6
https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marke…