CVE-2026-41397: OpenClaw Path Traversal Vulnerability

CVE-2026-41397 Overview

OpenClaw before version 2026.3.31 contains a sandbox escape vulnerability that allows attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions by crafting malicious symlinks in mirror sync operations to access arbitrary files outside intended boundaries.

This vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), which occurs when an application fails to properly resolve symbolic links before performing file operations. In the context of OpenClaw's mirror synchronization functionality, this flaw enables attackers to escape the intended sandbox environment and potentially access or modify sensitive files on the host system.

Critical Impact

Remote attackers can bypass sandbox restrictions through malicious symlinks during mirror sync operations, potentially gaining unauthorized access to arbitrary files outside the sandbox boundary with high impact to confidentiality and integrity.

Affected Products

• OpenClaw versions prior to 2026.3.31
• OpenShell extension component
• Systems using mirror sync functionality

Discovery Timeline

• 2026-04-28 - CVE CVE-2026-41397 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41397

Vulnerability Analysis

The vulnerability resides in OpenClaw's OpenShell extension, specifically within the mirror synchronization functionality implemented in the backend.ts and mirror.ts files. The core issue stems from insufficient validation of file paths and symbolic links during directory content replication operations.

When the replaceDirectoryContents function synchronizes files from a remote sandbox environment to the local workspace, it failed to implement proper exclusion mechanisms for sensitive directories. This oversight allows attackers to craft malicious symlinks that, when processed during synchronization, can traverse outside the intended sandbox boundaries.

The attack surface is particularly dangerous because mirrored content from a remote sandbox could include symbolic links pointing to arbitrary locations on the host filesystem. Without proper path validation and directory exclusion, these symlinks would be followed during sync operations, potentially exposing or overwriting sensitive files.

Root Cause

The root cause is the absence of directory exclusion filtering in the replaceDirectoryContents function within mirror.ts. Prior to the patch, the function would blindly synchronize all directory contents without checking if certain directories (such as hooks/) should be excluded from the sync operation.

The vulnerability is exacerbated by the lack of case-insensitive path matching on macOS and Windows systems, where filesystem operations are typically case-insensitive. An attacker could potentially bypass exclusion rules by using different letter casing (e.g., "Hooks" vs "hooks") to resolve to the same directory.

Attack Vector

The attack leverages the network-accessible mirror sync functionality in OpenClaw's OpenShell extension. An attacker with low privileges can exploit this vulnerability by:

1. Creating malicious symlinks within a remote sandbox environment
2. Triggering a mirror sync operation that copies content from the sandbox to the host workspace
3. Exploiting the lack of directory exclusion to sync attacker-controlled content into sensitive directories like hooks/
4. Achieving sandbox escape when the synced content is subsequently executed with host privileges

The following patches demonstrate the security hardening applied to mitigate this vulnerability:

// Security patch: OpenShell harden mirror sync boundaries
// Source: https://github.com/openclaw/openclaw/commit/3b9dab0ece4643a9643e6a45459f5c709d3ce320

 } from "./cli.js";
 import { resolveOpenShellPluginConfig, type ResolvedOpenShellPluginConfig } from "./config.js";
 import { createOpenShellFsBridge } from "./fs-bridge.js";
-import { replaceDirectoryContents } from "./mirror.js";
+import {
+  DEFAULT_OPEN_SHELL_MIRROR_EXCLUDE_DIRS,
+  replaceDirectoryContents,
+  stageDirectoryContents,
+} from "./mirror.js";

type CreateOpenShellSandboxBackendFactoryParams = {
   pluginConfig: ResolvedOpenShellPluginConfig;

// Security patch: Exclude hooks/ from mirror sync
// Source: https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1

       await replaceDirectoryContents({
         sourceDir: tmpDir,
         targetDir: this.params.createParams.workspaceDir,
+        // Never sync hooks/ from the remote sandbox — mirrored content must not
+        // become trusted workspace hook code on the host.
+        excludeDirs: ["hooks"],
       });
     } finally {
       await fs.rm(tmpDir, { recursive: true, force: true });

// Security patch: Case-insensitive directory exclusion in mirror.ts
// Source: https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1

 export async function replaceDirectoryContents(params: {
   sourceDir: string;
   targetDir: string;
+  /** Top-level directory names to exclude from sync (preserved in target, skipped from source). */
+  excludeDirs?: string[];
 }): Promise<void> {
+  // Case-insensitive matching: on macOS/Windows the filesystem is typically
+  // case-insensitive, so "Hooks" would resolve to the same directory as "hooks".
+  const excluded = new Set((params.excludeDirs ?? []).map((d) => d.toLowerCase()));
+  const isExcluded = (name: string) => excluded.has(name.toLowerCase());
   await fs.mkdir(params.targetDir, { recursive: true });
   const existing = await fs.readdir(params.targetDir);
   await Promise.all(
-    existing.map((entry) =>
-      fs.rm(path.join(params.targetDir, entry), {
-        recursive: true,
-        force: true,
-      }),
-    ),
+    existing
+      .filter((entry) => !isExcluded(entry))
+      .map((entry) =>
+        fs.rm(path.join(params.targetDir, entry), {
+          recursive: true,
+          force: true,
+        }),
+      ),
   );
   const sourceEntries = await fs.readdir(params.sourceDir);
   for (const entry of sourceEntries) {

Detection Methods for CVE-2026-41397

Indicators of Compromise

• Unexpected symbolic links appearing in workspace directories pointing outside sandbox boundaries
• Unusual file access patterns during mirror sync operations targeting sensitive system paths
• Presence of symlinks in hooks/ directories that reference external file locations
• File system events showing traversal patterns (e.g., ../ sequences) during sync operations

Detection Strategies

• Monitor file system operations for symlink creation that references paths outside designated sandbox directories
• Implement audit logging for all replaceDirectoryContents function calls in OpenShell extension
• Use endpoint detection tools to identify suspicious path traversal attempts during file synchronization
• Enable filesystem integrity monitoring on sensitive directories that should not receive mirrored content

Monitoring Recommendations

• Configure real-time alerts for symlink creation events in OpenClaw workspace directories
• Establish baseline behavior for mirror sync operations and alert on deviations
• Monitor for unauthorized access attempts to files outside sandbox boundaries following sync operations
• Track and log all OpenShell extension activities with full path resolution auditing

How to Mitigate CVE-2026-41397

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.31 or later immediately
• Audit existing workspace directories for suspicious symlinks that may indicate prior exploitation
• Review any files in hooks/ directories for unexpected or unauthorized content
• Temporarily disable mirror sync functionality if upgrade is not immediately possible

Patch Information

The vulnerability has been addressed through security patches that implement directory exclusion filtering in the mirror synchronization logic. The key fixes include:

1. Commit 3b9dab0: Introduces DEFAULT_OPEN_SHELL_MIRROR_EXCLUDE_DIRS and stageDirectoryContents to harden mirror sync boundaries (GitHub Commit)

2. Commit c02ee8a: Excludes hooks/ directory from mirror sync operations with case-insensitive matching to prevent mirrored content from becoming trusted workspace hook code on the host (GitHub Commit)

For additional details, refer to the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

• Disable mirror sync functionality in OpenShell extension configuration until patches can be applied
• Implement file system-level restrictions to prevent symlink creation in workspace directories
• Use containerization or additional sandboxing layers to limit the impact of potential sandbox escapes
• Configure workspace directories with nofollow mount options where supported to prevent symlink traversal

# Configuration example: Restrict symlink following on workspace mount (Linux)
# Add 'nosymfollow' option to workspace mount if using a dedicated partition
mount -o remount,nosymfollow /path/to/openclaw/workspace

# Alternative: Use chattr to make directories immutable temporarily
chattr +i /path/to/openclaw/workspace/hooks

# Verify OpenClaw version to ensure patched version is installed
openclaw --version
# Expected output: 2026.3.31 or later