CVE-2026-31990

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cfvj-7rx7-fc7c. This link is maintained to preserve external references.

Original Description

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

Summary

stageSandboxMedia allowed destination symlink traversal during media staging, which could overwrite files outside the sandbox workspace root.

Impact

When sandbox media staging handled inbound files, destination writes under media/inbound were not destination-alias-safe. If a symlink existed in that destination path, the write could follow it and overwrite host files outside the intended sandbox workspace boundary.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published version checked: 2026.3.1
• Affected: <= 2026.3.1
• Patched versions: >= 2026.3.2 (released)

Root Cause

stageSandboxMedia validated source paths but wrote destination files with a direct copy path that did not enforce destination boundary/alias checks.

Remediation

The fix routes staging writes through root-scoped safe write primitives for both local and SCP-staged attachments, preventing destination symlink traversal escapes.

Fix Commit(s)

• 17ede52a4be3034f6ec4b883ac6b81ad0101558a

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cfvj-7rx7-fc7c. This link is maintained to preserve external references.

Original Description

OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.

Summary

stageSandboxMedia allowed destination symlink traversal during media staging, which could overwrite files outside the sandbox workspace root.

Impact

When sandbox media staging handled inbound files, destination writes under media/inbound were not destination-alias-safe. If a symlink existed in that destination path, the write could follow it and overwrite host files outside the intended sandbox workspace boundary.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published version checked: 2026.3.1
• Affected: <= 2026.3.1
• Patched versions: >= 2026.3.2 (released)

Root Cause

stageSandboxMedia validated source paths but wrote destination files with a direct copy path that did not enforce destination boundary/alias checks.

Remediation

The fix routes staging writes through root-scoped safe write primitives for both local and SCP-staged attachments, preventing destination symlink traversal escapes.

Fix Commit(s)

• 17ede52a4be3034f6ec4b883ac6b81ad0101558a