CVE-2026-31990CWE-59

OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination

Medium · published March 19, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-03-19T01:00Z
EPSS history
Timeline
  • 19 MAR 01:00Z
    OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination
    cvelistv5