N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-r54r-wmmq-mh84

GHSA-r54r-wmmq-mh84: OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind

Summary

ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write.

Affected Packages / Versions

Package: openclaw (npm)
Vulnerable versions: <= 2026.3.1
Latest published vulnerable version confirmed: 2026.3.1 (npm as of 2026-03-02)
Patched version: 2026.3.2 (released)

Technical Details

In src/infra/archive.ts, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root.

The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in src/infra/fs-safe.ts and regression coverage in src/infra/archive.test.ts.

Fix Commit(s)

7dac9b05dd9d38dd3929637f26fa356fd8bdd107

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-r54r-wmmq-mh84

GHSA-r54r-wmmq-mh84:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.1	2026.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition within the ZIP extraction process of the 'openclaw' package. The root cause lies in the separation of path validation and file system write operations. The extractZip function would first validate the destination path for a file entry from the archive. Subsequently, it would call writeZipFileEntry, which in turn called openZipOutputFile to open and truncate the file at that path. An attacker could win a race by replacing a directory component in the validated path with a symbolic link pointing outside the intended extraction root. When openZipOutputFile was then called, it would follow the symlink and open/truncate a file outside the destination directory.

The patch addresses this by fundamentally changing how files are opened and written. The new openZipOutputFile implementation no longer trusts the path after the initial check. Instead, it opens a file handle and then uses mechanisms like fs.realpath on the file descriptor (e.g., via /proc/self/fd/ on Linux) to verify the true, final path of the opened file. It ensures this real path is within the destination directory and that the opened entity is a regular file, not a symlink. Only after these rigorous, post-open checks are passed is the file content written. This binds the security check to the identity of the file handle itself, eliminating the race condition window.

Vulnerable functions

openZipOutputFile

src/infra/archive.ts

This function was responsible for opening the output file for writing. The original implementation was vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. It would open a file path with write and truncate flags after a separate validation step had occurred. An attacker could change a directory in the file's path to a symbolic link between the validation and the file open operation, causing a file to be written outside the intended destination directory.

writeZipFileEntry

src/infra/archive.ts

This function orchestrates the writing of a single ZIP entry to a file. It was vulnerable because it relied on the insecure `openZipOutputFile` function to obtain a file handle. By calling the vulnerable function and then writing data to the returned handle, it completed the 'use' part of the TOCTOU vulnerability, writing data to a potentially malicious location.

extractZip

src/infra/archive.ts

This function is responsible for iterating through all entries in a ZIP archive and calling `writeZipFileEntry` for each file. This function contains the loop that enables the vulnerability to be triggered for any file within a malicious archive. The initial path validation happens within this loop, followed by the call to the vulnerable write function, creating the window for the race condition to be exploited.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.