CVE-2026-33574: OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-29 · updated 2026-06-17
Weakness: CWE-367

Description

OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path between validation and final write to redirect the installer outside the intended tools directory.

Affected products

OpenClaw: before 2026.3.8 — fixed in 2026.3.8

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.8. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/9abf014f3502009faf9c73df5ca2cff719e54639
https://github.com/openclaw/openclaw/security/advisories/GHSA-vhwf-4x96-vqx2
https://www.vulncheck.com/advisories/openclaw-path-traversal-via-tools-root-rebinding-in-skills-download

Get alerted when CVE-2026-33574 or the next vulnerability affects your stack