CVE-2026-32054
CVE-2026-32054 · OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managed temp root directory. An attacker with local access can create symlinks to route file writes outside the intended temp directory, enabling arbitrary file overwrite on the affected system.
CVSS 5.9 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-36h3-7c54-j27r
- https://github.com/openclaw/openclaw/commit/496a76c03ba85e15ea715e5a583e498ae04d36e3
- https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-browser-trace-download-path-handling
- https://nvd.nist.gov/vuln/detail/CVE-2026-32054