Description (CNA)
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name parameter unsanitized when copying skills into the sandbox workspace. Attackers who provide a crafted skill package with traversal sequences like ../ or absolute paths in the name field can write files outside the sandbox workspace root directory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenClaw / OpenClaw | affected 0 before 2026.2.14 |
CWE
CWE-22
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-xw4p-pw82-hqr7
- https://github.com/openclaw/openclaw/commit/3eb6a31b6fcf8268456988bfa8e3637d373438c2
- https://www.vulncheck.com/advisories/openclaw-path-traversal-in-sandbox-skill-mirroring-via-name-parameter
ADP enrichment
No English description supplied.
No references supplied.