A symlink traversal vulnerability in OpenClaw allows authenticated attackers to read or overwrite arbitrary files on the host system, potentially leading to remote code execution.

This vulnerability involves improper link resolution in the agents.files.get and agents.files.set methods. It requires an authenticated user to exploit the flaw, which can be leveraged to bypass workspace restrictions and manipulate files with the permissions of the gateway process.

Successful exploitation permits an attacker to perform unauthorized file operations on the underlying host, which poses a significant risk to data confidentiality and system integrity. Given the CVSS score of 8.8, this high-severity flaw could facilitate remote code execution if an attacker overwrites critical system configuration files or binaries. This could result in complete system compromise and potential lateral movement within the network.

Immediate Action: Update the OpenClaw package to version 2026.2.25 or later to incorporate the security fix provided by the vendor.

Proactive Monitoring: Review system and application logs for suspicious file access patterns or unusual activity involving the agents.files endpoints.

Compensating Controls: Implement strict file system permissions for the gateway process to limit the impact of potential file access, and utilize a Web Application Firewall to monitor for abnormal API requests.

Public Exploit Available: Yes — a public proof-of-concept repository is available via PoC-in-GitHub.

The severity of this flaw necessitates immediate attention, particularly in environments where OpenClaw agents are deployed with elevated host permissions. Administrators must prioritize updating to version 2026.2.25 to neutralize the file traversal risk. Failure to apply this update leaves the host system vulnerable to unauthorized file manipulation and potential code execution.