Link following in OpenClaw - CVE-2026-22180
Published: April 8, 2026
Vulnerability identifier: #VU125123
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22180
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to write files outside intended roots.
The vulnerability exists due to improper link resolution before file access in browser output handling and related write paths when processing path-boundary flows. A local user can use a crafted path or symlink rebind to write files outside intended roots.
The issue involves browser output as well as related install and skills write paths.
Affected software
OpenClaw
How to mitigate CVE-2026-22180
Install security update from vendor's website.
OpenClaw - update to 2026.3.2