Path Traversal Vulnerability in Crabbox by Openclaw

CVE-2026-45224

What is CVE-2026-45224?

Crabbox prior to version 0.9.0 is susceptible to a path traversal vulnerability due to improper handling of workspace path resolution in the Islo provider. Attackers can exploit this flaw by supplying crafted file paths in malicious .crabbox.yaml files. This exploitation could lead to severe consequences, including unauthorized access to files outside the designated /workspace directory, and potential arbitrary file deletion or overwriting when the sync.delete operation is enabled. The flaw arises because the application's path verification lacks adequate validation mechanisms during directory preparation, allowing for execution of potentially harmful rm -rf and mkdir -p commands on affected file paths.

References