6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27008

CVE-2026-27008: OpenClaw hardened the skill download target directory validation

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.14
Fixed in: planned release 2026.2.15

Impact

A bug in download skill installation allowed targetDir values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only skills.install flow, this could write files outside the intended install sandbox.

Fix Commit(s)

2363e1b08 fix(security): restrict skill download target paths
b6305e972 test(skills): split installer security coverage

Acknowledgement

Thanks @Adam55A-code for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27008

CVE-2026-27008:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.15	2026.2.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue within the skill installation feature of OpenClaw. The root cause lies in the resolveDownloadTargetDir function in src/agents/skills-install.ts. This function was responsible for determining the destination directory for downloaded skill assets. It directly used the targetDir value from a skill's metadata, resolving it with resolveUserPath without proper sanitization or validation. This allowed a malicious actor to craft a skill with a targetDir like ../../../../tmp/pwned to write files outside the intended sandboxed tools directory.

The patch addresses this by refactoring the download logic into a new file, src/agents/skills-install-download.ts. The new implementation of resolveDownloadTargetDir now establishes a safe root directory for the skill and uses a new isWithinDir utility function to ensure that the resolved targetDir is strictly confined within this safe root. If the path falls outside, the installation is aborted. The function installDownloadSpec was the consumer of the insecure path and was also moved and now benefits from the new, secure path resolution. The main entry point, installSkill, remains the primary function that would be seen in a runtime profile during exploitation.

Vulnerable functions

resolveDownloadTargetDir

src/agents/skills-install.ts

This function was responsible for resolving the target directory for skill installation. The vulnerable version directly used `resolveUserPath` on the `targetDir` provided in the skill's metadata without any validation. This allowed a malicious `targetDir` with path traversal characters (e.g., `../`) to cause files to be written outside the intended installation directory.

installDownloadSpec

src/agents/skills-install.ts

This function orchestrates the download and extraction of a skill. It calls the vulnerable `resolveDownloadTargetDir` function and then proceeds to download and extract an archive to the returned path. This makes it a key function in the exploitation of the path traversal vulnerability, as it performs the file write operations to the attacker-controlled directory.

installSkill

src/agents/skills-install.ts

This is the main exported function that triggers the skill installation process. While it does not contain the vulnerable path resolution logic itself, it is the primary entry point for the `skills.install` flow and would appear in any runtime profile or stack trace when the vulnerability is exploited. It initiates the chain of calls that leads to the vulnerable `resolveDownloadTargetDir` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27008: OpenClaw hardened the skill download target directory validation

Affected Packages / Versions

Impact

Fix Commit(s)

Acknowledgement

CVE-2026-27008:

6.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

CVE-2026-27008: OpenClaw hardened the skill download target directory validation

Affected Packages / Versions

Impact

Fix Commit(s)

Acknowledgement

6.8

6.8

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI