CVE-2026-31990

MEDIUM

6.1

Beschreibung

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

CVE Details

CVSS v3.1 Bewertung6.1

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht3/19/2026

Zuletzt geandert3/19/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

openclaw:openclaw

Schwachen (CWE)

CWE-59

Referenzen

https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-stagesandboxmedia-destination(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.