{"id":"CVE-2026-31990","aliases":["EUVD-2026-13019","GHSA-2cwr-f5hx-gg3w","GHSA-cfvj-7rx7-fc7c"],"status":"published","title":"OpenClaw \u003c 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination","description":"OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00142,"percentile":0.03593,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-03-03T21:18:28Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2026.3.1"},{"fixed":"2026.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.3.2"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c","tags":["vendor-advisory","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a","tags":["patch","Patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-stagesandboxmedia-destination","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31990","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2cwr-f5hx-gg3w"},{"url":"https://github.com/advisories/GHSA-cfvj-7rx7-fc7c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31990.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-31990","title":"OpenClaw \u003c 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination","description":"OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.","status":"published","published":"2026-03-19T01:00:49.811Z","modified":"2026-06-23T16:14:19.884Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:19:51.277563Z"}],"euvd":[{"id":"EUVD-2026-13019","description":"OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.","status":"published","published":"2026-03-19T01:00:49Z","modified":"2026-06-23T16:14:19Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-2cwr-f5hx-gg3w","title":"Duplicate Advisory: OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-cfvj-7rx7-fc7c. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.","status":"withdrawn","published":"2026-03-19T03:30:57Z","modified":"2026-03-19T16:26:20Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:39:37.554665Z"},{"id":"GHSA-cfvj-7rx7-fc7c","title":"OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace","description":"### Summary\n`stageSandboxMedia` allowed destination symlink traversal during media staging, which could overwrite files outside the sandbox workspace root.\n\n### Impact\nWhen sandbox media staging handled inbound files, destination writes under `media/inbound` were not destination-alias-safe. If a symlink existed in that destination path, the write could follow it and overwrite host files outside the intended sandbox workspace boundary.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published version checked: `2026.3.1`\n- Affected: `\u003c= 2026.3.1`\n- Patched versions: `\u003e= 2026.3.2` (released)\n\n### Root Cause\n`stageSandboxMedia` validated source paths but wrote destination files with a direct copy path that did not enforce destination boundary/alias checks.\n\n### Remediation\nThe fix routes staging writes through root-scoped safe write primitives for both local and SCP-staged attachments, preventing destination symlink traversal escapes.\n\n### Fix Commit(s)\n- `17ede52a4be3034f6ec4b883ac6b81ad0101558a`","status":"published","published":"2026-03-03T21:18:28Z","modified":"2026-03-19T21:22:16Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:39:38.524712Z"}],"nvd":[{"id":"CVE-2026-31990","description":"OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.","status":"published","published":"2026-03-19T02:16:03.647Z","modified":"2026-06-17T10:34:53.387Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-31990","title":"OpenClaw \u003c 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination","description":"OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.","status":"published","published":"2026-03-19T01:00:49.811Z","modified":"2026-10-28T02:31:04.782611673Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"GHSA-2cwr-f5hx-gg3w","title":"Duplicate Advisory: OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-cfvj-7rx7-fc7c. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.","status":"withdrawn","published":"2026-03-19T03:30:57Z","modified":"2026-03-19T16:31:31.350592Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"GHSA-cfvj-7rx7-fc7c","title":"OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace","description":"### Summary\n`stageSandboxMedia` allowed destination symlink traversal during media staging, which could overwrite files outside the sandbox workspace root.\n\n### Impact\nWhen sandbox media staging handled inbound files, destination writes under `media/inbound` were not destination-alias-safe. If a symlink existed in that destination path, the write could follow it and overwrite host files outside the intended sandbox workspace boundary.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published version checked: `2026.3.1`\n- Affected: `\u003c= 2026.3.1`\n- Patched versions: `\u003e= 2026.3.2` (released)\n\n### Root Cause\n`stageSandboxMedia` validated source paths but wrote destination files with a direct copy path that did not enforce destination boundary/alias checks.\n\n### Remediation\nThe fix routes staging writes through root-scoped safe write primitives for both local and SCP-staged attachments, preventing destination symlink traversal escapes.\n\n### Fix Commit(s)\n- `17ede52a4be3034f6ec4b883ac6b81ad0101558a`","status":"published","published":"2026-03-03T21:18:28Z","modified":"2026-03-19T21:41:21.211376Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}