N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xmv6-r34m-62p4

GHSA-xmv6-r34m-62p4: OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot

Summary

A sandbox path validation bypass in openclaw allows host file reads outside sandboxRoot via the media path fallback tmp flow when the fallback tmp root is a symlink alias.

Affected Packages / Versions

Package: npm openclaw
Affected versions: <= 2026.2.24
Latest published npm version at triage time (February 26, 2026): 2026.2.24
Patched version : 2026.2.25

Details

When /tmp/openclaw is unavailable or unsafe, resolvePreferredOpenClawTmpDir() in src/infra/tmp-openclaw-dir.ts fell back to os.tmpdir()/openclaw-<uid> without verifying that fallback path was a trusted non-symlink directory.

resolveSandboxedMediaSource() (src/agents/sandbox-paths.ts) allows absolute tmp media paths under the OpenClaw tmp root using lexical containment and alias checks. If the fallback tmp root is a symlink alias (for example to /), inputs like $TMPDIR/openclaw-<uid>/etc/passwd can pass validation and resolve to host files outside sandboxRoot.

Impact

This can break sandbox media path confinement and permit unauthorized host file reads (confidentiality impact).

Reproduction (high level)

Force resolver fallback (make /tmp/openclaw unavailable/invalid).
Make fallback root ($TMPDIR/openclaw-<uid>) a symlink alias to /.
Submit media path under fallback root (for example $TMPDIR/openclaw-<uid>/etc/passwd).
Observe accepted path and read outside sandboxRoot.

Fix Commit(s)

496a76c03ba85e15ea715e5a583e498ae04d36e3

Miggo Vulnerability Database

→

GHSA-xmv6-r34m-62p4

GHSA-xmv6-r34m-62p4:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.24	2026.2.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue caused by improper handling of symbolic links in temporary directory creation and file path validation. The root cause lies in the resolvePreferredOpenClawTmpDir function in src/infra/tmp-openclaw-dir.ts. When its primary temporary directory is unavailable, it falls back to a user-specific directory in the OS's temporary folder without ensuring this fallback path is not a symlink. An attacker can pre-create this fallback path as a symlink to /.

Subsequently, other parts of the application that handle file operations, such as downloads and trace saving, trust this temporary directory to be a safe root. Functions like resolvePathWithinRoot in src/browser/paths.ts were used to validate that file paths are within this root. However, resolvePathWithinRoot only performed lexical checks and did not resolve symlinks.

This combination allows an attacker to bypass the sandbox. For example, a request to download a file to $TMPDIR/openclaw-<uid>/etc/passwd would pass the resolvePathWithinRoot check because lexically it is inside the temporary directory. But because $TMPDIR/openclaw-<uid> is a symlink to /, the application would actually write to or read from /etc/passwd.

The patch addresses this in two ways:

It hardens resolvePreferredOpenClawTmpDir by adding ensureTrustedFallbackDir, which validates that the fallback directory is a real, trusted directory and not a symlink.
It replaces the insecure resolvePathWithinRoot with a new resolveWritablePathWithinRoot function. This new function explicitly checks for symlinks in the path and ensures the real, canonicalized path of the target file is within the intended root directory. This change is applied in src/browser/routes/agent.act.ts and src/browser/routes/agent.debug.ts, which handle file downloads and trace outputs.

Vulnerable functions

resolvePreferredOpenClawTmpDir

src/infra/tmp-openclaw-dir.ts

The function `resolvePreferredOpenClawTmpDir` is responsible for determining a temporary directory. The vulnerability lies in its fallback mechanism. When the preferred directory (`/tmp/openclaw`) is unavailable or invalid, it would return a fallback path (`os.tmpdir()/openclaw-<uid>`) without verifying if this path is a symbolic link. This allows an attacker to create a symlink at the fallback path pointing to an arbitrary location on the filesystem (e.g., '/'), thus tricking the application into treating that location as a valid temporary directory.

resolvePathWithinRoot

src/browser/paths.ts

This function was used for validating if a given path is within a specified root directory. However, it only performed lexical checks (i.e., string manipulation on the path). It did not resolve symbolic links. When combined with the vulnerability in `resolvePreferredOpenClawTmpDir`, an attacker could provide a path that is lexically within the symlinked temporary directory but actually resolves to a sensitive file outside of the intended sandbox (e.g., `/etc/passwd`).

resolveDownloadPathOrRespond

src/browser/routes/agent.act.ts

This function handles user-provided paths for file downloads. It used the vulnerable `resolvePathWithinRoot` function for path validation. By supplying a crafted path, an attacker could exploit the lack of symlink checks to make this function approve a path that points to a file outside the designated downloads directory, leading to arbitrary file reads.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-xmv6-r34m-62p4: OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot

Summary

Affected Packages / Versions

Details

Impact

Reproduction (high level)

Fix Commit(s)

GHSA-xmv6-r34m-62p4:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

N/A

N/A

Basic Information

Basic Information

GHSA-xmv6-r34m-62p4: OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot

Summary

Affected Packages / Versions

Details

Impact

Reproduction (high level)

Fix Commit(s)

Release Process Note

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI