A path traversal vulnerability in OpenClaw allows authenticated attackers to overwrite arbitrary files on the system, posing a significant risk to file integrity.

This vulnerability is a path traversal flaw (CWE-22) residing in the workspace boundary validation logic. An authenticated attacker can exploit the improper resolution of symlinks to escape the intended workspace directory and perform arbitrary file writes on the host system.

The ability to write arbitrary files to the filesystem can lead to full system compromise, including the potential for remote code execution if configuration files or binaries are overwritten. Given the CVSS score of 7.6, this is a high-severity issue that threatens the confidentiality, integrity, and availability of the affected environment. Unauthorized file modifications may also lead to severe service disruption and data loss.

Immediate Action: Update the OpenClaw package to version 2026.2.26 or later to incorporate the necessary boundary validation fixes.

Proactive Monitoring: Review system logs for unusual file creation events or attempts to access directories outside of defined workspace paths.

Compensating Controls: Implement strict filesystem permissions to limit the impact of potential write operations and ensure that the application process runs with the least privilege necessary.

Public Exploit Available: Unknown

Organizations utilizing OpenClaw must prioritize updating to version 2026.2.26 as soon as possible to mitigate the risk of path traversal attacks. Ensuring the application is patched is essential to preventing potential unauthorized filesystem access and maintaining the overall security posture of the host environment.