OpenClaw: Zip extraction symlink traversal could write outside destination
Summary
A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version at triage time:
2026.2.21-2 - Affected versions:
<= 2026.2.21-2 - Planned patched version for next release:
2026.2.22
Technical Details
The vulnerable path was in src/infra/archive.ts ZIP extraction logic. Output-path checks were lexical, but writes could still traverse an existing symlink in destination path segments.
The fix blocks this by:
- rejecting symlink traversal in destination path segments,
- validating resolved destination paths remain inside the extraction root,
- using no-follow file opens for ZIP output writes where supported,
- adding a regression test for pre-seeded destination symlink traversal.
Impact
- Type: Arbitrary file write outside extraction root via symlink traversal during ZIP extraction.
- Preconditions: attacker-controlled archive extraction plus pre-existing symlink in destination path.
Fix Commit(s)
- 4b226b74f5fd3b106a83a6347fd404172e2fd246
Release Process Note
Patched version is pre-set to the planned next release (2026.2.22).
Once npm release 2026.2.22 is published, the advisory can be published without further field edits.
OpenClaw thanks @tdjackey for reporting.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.2.22 | 2026.2.22 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-59- Platform
- npm
- Package
openclaw- Disclosed
- 03.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jxrq-8fm4-9p58 - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 589
- First → latest
- 02.2026 10.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 300
- Low 54
Disclosures per year
- 2026: 589
-
OpenClaw: Zip extraction symlink traversal could write outside destination this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.