An authenticated directory traversal vulnerability in OpenClaw allows remote attackers to delete unintended directory contents, posing a significant risk to data integrity and system availability.

This is a path traversal vulnerability (CWE-22) that allows an authenticated attacker to influence the remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. By manipulating these paths, an attacker can force the mirror sync process to delete arbitrary remote directories and replace them with malicious workspace data.

The ability to arbitrarily delete directories on a remote system facilitates severe data loss and potential service disruption. Given the CVSS score of 8.1, this vulnerability is classified as High, reflecting the significant impact on data integrity and availability, even though it requires low-privileged authentication to trigger.

Immediate Action: Upgrade the OpenClaw package to version 2026.4.2 or later to apply the necessary path validation fixes.

Proactive Monitoring: Review system logs for unauthorized modifications to configuration files and monitor for unusual file deletion activity initiated by the OpenClaw agent.

Compensating Controls: Implement strict file system permissions on the server to limit the write and delete access of the service account running the OpenClaw agent.

Public Exploit Available: Unknown

Organizations utilizing OpenClaw must prioritize the upgrade to version 2026.4.2 to eliminate this path traversal risk. Failure to patch allows authenticated users to execute destructive actions against the underlying file system, potentially resulting in catastrophic data loss.