Symlink Traversal Vulnerability in OpenClaw by OpenClaw

CVE-2026-32013

What is CVE-2026-32013?

Versions of OpenClaw prior to 2026.2.25 are susceptible to a symlink traversal vulnerability within the agents.files.get and agents.files.set methods. This flaw allows malicious actors to exploit symlinked files that appear in the allowlist, granting them the ability to read and write files located outside the designated agent workspace. By leveraging this vulnerability, attackers can potentially gain access to arbitrary host files under the permissions set by the gateway process, which may lead to code execution via file overwrite attacks. It is crucial for users of affected versions to apply the necessary patches to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References