CVE-2026-41397
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
6.8 / 10
Vector String
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability Description
OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions by crafting malicious symlinks in mirror sync operations to access arbitrary files outside intended boundaries.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-59
Source
NVD
Vendor
OpenClaw
Product
OpenClaw
External References
- https://github.com/openclaw/openclaw/commit/3b9dab0ece4643a9643e6a45459f5c709d3ce320
- https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cwf8-44x6-32c2
- https://www.vulncheck.com/advisories/openclaw-sandbox-escape-via-unrestricted-file-sync-and-symlink-traversal
Discussion (0)
Add Comment
No comments yet. Be the first!