CVE-2026-43570
OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.
| CWE | CWE-61 |
| Vendor | openclaw |
| Product | openclaw |
| Published | May 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new medium vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
OpenClaw / OpenClaw
2026.3.22 < 2026.4.5
References
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6 github.com: https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c537f3a github.com: https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538edaeae vulncheck.com: https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marketplace-repository-path-handling
Credits
🔍 zsx (@zsxsoft) KeenSecurityLab