CVE-2026-22180: OpenClaw Path Traversal Vulnerability

CVE-2026-22180 Overview

OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directories. Attackers can exploit insufficient canonical path-boundary validation in file write operations to escape root-bound restrictions and write files to arbitrary locations. This vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access).

Critical Impact

Local attackers with low privileges can bypass path confinement controls to write files to arbitrary locations on the filesystem, potentially enabling code execution or system compromise through symlink attacks.

Affected Products

• OpenClaw versions prior to 2026.3.2

Discovery Timeline

• 2026-03-18 - CVE-2026-22180 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-22180

Vulnerability Analysis

This vulnerability stems from improper link resolution and insufficient path boundary validation within OpenClaw's file system bridge component. The flaw allows an attacker to craft malicious file paths that escape the intended sandbox root directory, enabling arbitrary file writes to locations outside the confined environment.

The vulnerability affects the browser output handling mechanism and file write operations within the sandbox environment. Without proper canonical path validation, symbolic links or specially crafted path components can be used to traverse beyond the intended root directory boundaries.

Root Cause

The root cause is insufficient canonical path-boundary validation in the file system bridge (fs-bridge.ts). Prior to the patch, file operations such as rm commands did not properly validate that target paths remained within the sandbox root directory after resolving symlinks and path components. This allowed path confinement bypass through improper link resolution (CWE-59).

Attack Vector

The attack requires local access with low privileges. An attacker can exploit this vulnerability by:

1. Creating symbolic links or crafting path components that reference locations outside the sandbox root
2. Triggering file write operations through the browser output handling mechanism
3. Exploiting the lack of path safety assertions to write files to arbitrary filesystem locations

The vulnerability can be chained with other techniques to achieve privilege escalation or code execution by overwriting sensitive system files or configuration.

The security patch introduces path safety assertions with configurable alias policies:

       Boolean,
     );
     const rmCommand = flags.length > 0 ? `rm ${flags.join(" ")}` : "rm";
+    await this.assertPathSafety(target, {
+      action: "remove files",
+      requireWritable: true,
+      aliasPolicy: PATH_ALIAS_POLICIES.unlinkTarget,
+    });
     await this.runCommand(`set -eu; ${rmCommand} -- "$1"`, {
       args: [target.containerPath],
       signal: params.signal,

Source: GitHub Commit Update

The fix adds assertPathSafety() calls with proper policies to validate paths before file operations proceed, ensuring all operations remain within the intended root boundaries.

Detection Methods for CVE-2026-22180

Indicators of Compromise

• Unexpected file modifications outside the OpenClaw sandbox directories
• Symbolic links pointing from sandbox directories to sensitive system locations
• Log entries showing file operations targeting paths outside expected root boundaries
• Unauthorized configuration file changes in system directories

Detection Strategies

• Monitor file system operations for writes outside expected OpenClaw working directories
• Implement file integrity monitoring on critical system files and configurations
• Audit symbolic link creation within OpenClaw sandbox environments
• Review access logs for anomalous path patterns containing traversal sequences

Monitoring Recommendations

• Enable detailed logging for OpenClaw file system bridge operations
• Configure SentinelOne to alert on symlink-based attacks and path traversal attempts
• Implement canary files in sensitive directories to detect unauthorized writes
• Monitor process activity for OpenClaw instances accessing unexpected file paths

How to Mitigate CVE-2026-22180

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.2 or later immediately
• Audit existing sandbox environments for suspicious symbolic links or file modifications
• Review file permissions on sensitive system directories to limit potential impact
• Restrict local access privileges to OpenClaw installations until patching is complete

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.2. The patch introduces unified root-bound write hardening through the assertPathSafety() function with configurable path alias policies. The fix ensures all file operations validate that target paths remain within the intended sandbox boundaries after symlink resolution.

For detailed patch information, refer to the GitHub Security Advisory GHSA-3pxq-f3cp-jmxp or the GitHub Commit Update.

Workarounds

• Implement additional access controls to restrict file system permissions for OpenClaw processes
• Deploy mandatory access control (MAC) policies using SELinux or AppArmor to confine OpenClaw file operations
• Disable browser output handling features if not required in your deployment
• Use read-only mounts for sensitive directories to prevent unauthorized writes

# Example: Restrict OpenClaw sandbox with additional AppArmor profile
# /etc/apparmor.d/openclaw-sandbox
profile openclaw-sandbox {
  # Deny writes outside sandbox root
  deny /etc/** w,
  deny /usr/** w,
  deny /var/** w,
  
  # Allow writes only within sandbox
  /opt/openclaw/sandbox/** rw,
}