CVE-2026-32232: ZeptoClaw Path Traversal Vulnerability

CVE-2026-32232 Overview

CVE-2026-32232 affects ZeptoClaw, a personal AI assistant application. Prior to version 0.7.6, the application contains multiple path validation vulnerabilities including a Dangling Symlink Component Bypass, a Time-of-Check Time-of-Use (TOCTOU) vulnerability between validation and use, and a Hardlink Alias Bypass. These combined weaknesses allow attackers to bypass security controls and access files outside the intended workspace directory.

Critical Impact

Attackers can exploit these path traversal vulnerabilities to read or write arbitrary files on the system by manipulating symbolic links and hardlinks to bypass workspace security boundaries, potentially leading to unauthorized data access or system compromise.

Affected Products

• ZeptoClaw versions prior to 0.7.6

Discovery Timeline

• 2026-03-12 - CVE CVE-2026-32232 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32232

Vulnerability Analysis

This vulnerability combines three distinct attack vectors that together compromise the path validation security mechanisms in ZeptoClaw. The application's path validation logic contains fundamental flaws that allow attackers to escape the designated workspace sandbox.

The first component, the Dangling Symlink Component Bypass, occurs when the application validates a path that includes a symbolic link pointing to a non-existent target. An attacker can create a symlink to a path outside the workspace, then later create the target, causing the application to follow the link outside its intended boundaries.

The TOCTOU (Time-of-Check Time-of-Use) vulnerability exists between the moment path validation occurs and when the file operation actually executes. During this window, an attacker with concurrent access can swap a legitimate path for a malicious symlink, bypassing the initial security check.

The Hardlink Alias Bypass allows attackers to create hardlinks within the workspace that point to files outside it, effectively aliasing sensitive system files to appear as if they reside within the allowed directory.

Root Cause

The root cause stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal). The original implementation in src/security/path.rs performed path validation once during the initial access request but failed to revalidate the path immediately before use. Additionally, the validation logic did not account for dangling symlinks that could be materialized later or hardlinks that alias external files.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and requires no user interaction or privileges. An attacker can craft requests to the ZeptoClaw AI assistant that manipulate file paths to escape workspace restrictions. The attack can be executed by:

1. Creating a dangling symlink within the workspace pointing outside the allowed directory
2. Exploiting the TOCTOU window by racing between validation and file access
3. Creating hardlinks to sensitive files outside the workspace boundary

The security patch introduces proper hardlink checking and path revalidation:

 pub use encryption::{is_secret_field, resolve_master_key, SecretEncryption};
 pub use mount::{validate_extra_mounts, validate_mount_not_blocked, DEFAULT_BLOCKED_PATTERNS};
 pub use pairing::{DeviceInfo, PairedDevice, PairingManager};
-pub use path::{validate_path_in_workspace, SafePath};
+pub use path::{check_hardlink_write, revalidate_path, validate_path_in_workspace, SafePath};
 pub use shell::{ShellAllowlistMode, ShellSecurityConfig};

Source: GitHub Commit Details

The fix also updates file operation modules to use the new revalidation function:

 use std::path::PathBuf;
 
 use crate::error::{Result, ZeptoError};
-use crate::security::validate_path_in_workspace;
+use crate::security::{revalidate_path, validate_path_in_workspace};
 
 use super::{Tool, ToolContext, ToolOutput};

Source: GitHub Commit Details

Detection Methods for CVE-2026-32232

Indicators of Compromise

• Unusual symlink creation patterns within ZeptoClaw workspace directories, particularly symlinks pointing outside the workspace boundary
• File access attempts to sensitive system files (e.g., /etc/passwd, /etc/shadow, configuration files) originating from ZeptoClaw processes
• Hardlink creation to files outside designated workspace directories
• Rapid successive file operations that may indicate TOCTOU exploitation attempts

Detection Strategies

• Monitor filesystem operations from ZeptoClaw processes for symlink resolution paths that traverse outside workspace boundaries
• Implement file integrity monitoring on sensitive system files to detect unauthorized access attempts
• Deploy endpoint detection rules that alert on symlink/hardlink creation within application workspace directories
• Analyze ZeptoClaw application logs for path traversal patterns containing ../ sequences or absolute paths

Monitoring Recommendations

• Enable detailed audit logging for file system operations in environments running ZeptoClaw
• Configure SentinelOne Deep Visibility to monitor process-level file access patterns from ZeptoClaw executables
• Set up alerts for any ZeptoClaw process attempting to access files outside its designated workspace
• Monitor for race condition indicators such as rapid file metadata changes followed by file reads/writes

How to Mitigate CVE-2026-32232

Immediate Actions Required

• Upgrade ZeptoClaw to version 0.7.6 or later immediately to receive the security fix
• Audit existing ZeptoClaw workspace directories for suspicious symlinks or hardlinks that may indicate prior exploitation
• Restrict filesystem permissions for the ZeptoClaw application to minimize potential impact
• Review any files that may have been accessed or modified through path traversal attacks

Patch Information

The vulnerability has been fixed in ZeptoClaw version 0.7.6. The patch introduces two new security functions: check_hardlink_write and revalidate_path. These functions ensure that path validation occurs immediately before file operations and properly detect hardlink aliases to files outside the workspace. For technical details, see the GitHub Security Advisory GHSA-2m67-cxxq-c3h8 and the security patch commit.

Workarounds

• If immediate patching is not possible, consider temporarily disabling file access capabilities in ZeptoClaw until the update can be applied
• Run ZeptoClaw in a containerized environment with restricted filesystem access to limit the impact of path traversal
• Implement additional filesystem-level access controls (e.g., SELinux, AppArmor policies) to prevent access outside workspace directories
• Disable symlink and hardlink following at the filesystem level for the ZeptoClaw workspace if operationally feasible

# Example: Restrict workspace permissions and disable symlink following
chmod 700 /path/to/zeptoclaw/workspace
# Run ZeptoClaw with reduced privileges
sudo -u zeptoclaw-service /usr/bin/zeptoclaw --workspace=/path/to/zeptoclaw/workspace