Vulnerability · Published Mar 19, 2026 · Assigned by VulnCheck
CVE-2026-32020OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler
Low 3.3
In plain English
A low-severity security flaw in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads. Attackers can place symlinks under the Control UI root directory to bypass directory confinement checks and read arbitrary files outside the intended root.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | openclaw | 2026.2.22 | GHSA-5ghc-98wh-gwwf |
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-5ghc-98wh-gwwf) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler third-party-advisory