A path traversal vulnerability in OpenClaw allows authenticated attackers to manipulate arbitrary files on the host system, posing a significant risk of system compromise.

This is a path traversal flaw (CWE-22) residing in the apply_patch function. An authenticated attacker can supply crafted paths to escape the intended workspace boundaries, allowing for unauthorized file modification or deletion.

The ability to write or delete arbitrary files on the host system provides an attacker with a direct path to achieve remote code execution, privilege escalation, or permanent denial of service. Given the high CVSS score of 8.8, this vulnerability represents a severe threat to data integrity and system availability. Organizations relying on OpenClaw for sensitive operations face potential unauthorized access to system configurations and core application data.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review system logs for suspicious file operations, particularly those involving directory traversal sequences or unexpected access to system-level directories outside of the application workspace.

Compensating Controls: Ensure that the OpenClaw service is running within a strictly defined filesystem sandbox or a containerized environment to restrict its ability to interact with the broader host filesystem.

Public Exploit Available: Unknown

CVE-2026-32060 represents a critical security oversight in path handling that can lead to total system compromise. IT administrators must prioritize the update to version 2026.2.14 to eliminate the underlying flaw. Given the potential for unauthorized file manipulation, failure to patch this vulnerability leaves the environment exposed to significant risk.