What’s Vulnerable › Vulnerabilities

CVE-2026-31990: OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-19 · updated 2026-06-17
• Weakness: CWE-59

Description

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

Affected products

• OpenClaw: before 2026.3.2 — fixed in 2026.3.2

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.2. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c
• https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-stagesandboxmedia-destination

Get alerted when CVE-2026-31990 or the next vulnerability affects your stack