Nixpkgs security tracker
Dismissed
Permalink
CVE-2026-32013
8.8 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
by @pyrox0 Activity log
- Created suggestion
- @pyrox0 dismissed
OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods
OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside the agent workspace. Attackers can exploit symlinked allowlisted files to access arbitrary host files within gateway process permissions, potentially enabling code execution through file overwrite attacks.
References
-
GitHub Security Advisory (GHSA-fgvx-58p6-gjwc) third-party-advisory
-
Patch Commit patch
-
VulnCheck Advisory: OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods third-party-advisory
Affected products
OpenClaw
- <2026.2.25
- ==2026.2.25
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>