CVE-2026-31990
OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 19, 2026
- Updated
- Jun 23, 2026
- Reserved
- Mar 10, 2026
Description
OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L | VulnCheck |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-cfvj-7rx7-fc7c)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destinationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.