Mar 4, 2026·5 min read·16 visits
OpenClaw versions before 2026.1.29 are vulnerable to a 'Zip Slip' variant involving symbolic links. Attackers can overwrite arbitrary files on the host system if the extraction directory contains a symlink pointing to a sensitive location.
A critical path traversal vulnerability exists in the OpenClaw AI assistant platform's archive extraction logic. The flaw allows attackers to bypass directory confinement by leveraging pre-existing symbolic links within the destination directory. This facilitates arbitrary file writes outside the intended extraction root, potentially leading to Remote Code Execution (RCE) by overwriting sensitive system files or application code.
A path traversal vulnerability was identified in the openclaw package, specifically within the module responsible for extracting ZIP archives. The vulnerability is a variant of the "Zip Slip" attack (CWE-22) but relies specifically on the mishandling of symbolic links (CWE-59) rather than standard parent directory traversal sequences (../).
The affected component is the archive extraction utility used by OpenClaw to process user-uploaded content, such as third-party skills, plugins, or avatar assets. When extracting a compressed archive, the application failed to validate whether the resolved path of a file entry effectively traversed outside the intended destination directory due to symbolic links already present on the filesystem. This oversight allows an attacker to write files to arbitrary locations on the server, provided they can influence the contents of the extraction directory prior to the malicious extraction event.
The root cause of the vulnerability lies in the reliance on lexical path validation rather than canonical path resolution. The extraction logic constructed the output path using path.join(destination, entryName) and subsequently verified if the resulting string began with the destination directory string.
This approach is insufficient because it ignores the filesystem state. While path.join resolves ../ sequences, it does not resolve symbolic links. If the destination directory contains a symbolic link (e.g., link -> /etc), a file entry named link/passwd would result in a path string that lexically appears safe (e.g., /tmp/extract/link/passwd starts with /tmp/extract). However, when the operating system performs the write operation, it follows the symlink, redirecting the write to /etc/passwd.
The vulnerability highlights a Time-of-Check Time-of-Use (TOCTOU) discrepancy where the application validates the abstract path string but the operating system acts on the concrete inode structure.
The remediation introduces a defense-in-depth strategy that validates path segments against symbolic links and enforces strict file open flags. The fix is located in src/infra/archive.ts.
Vulnerable Logic (Conceptual): The original code performed a simple prefix check:
const outPath = path.join(destDir, entry.name);
if (!outPath.startsWith(destDir)) throw new Error("Invalid path");
// Proceed to write to outPathPatched Logic:
The fix introduces assertNoSymlinkTraversal, which iterates through every segment of the relative path to ensure no component is a symbolic link. It also employs O_NOFOLLOW during file creation to prevent following symlinks at the final path component.
// From src/infra/archive.ts
async function assertNoSymlinkTraversal(params: { rootDir: string; relPath: string; }) {
const parts = params.relPath.split("/").filter(Boolean);
let current = path.resolve(params.rootDir);
// Iteratively check every path segment
for (const part of parts) {
current = path.join(current, part);
// Explicitly check for symlinks
let stat = await fs.lstat(current).catch(() => null);
if (stat && stat.isSymbolicLink()) {
throw new Error(`archive entry traverses symlink: ${params.originalPath}`);
}
}
}Additionally, the patch resolves the real path of the destination directory before extraction begins (assertDestinationDirReady) to ensure the root itself is not a redirection.
Exploiting this vulnerability requires a "pivot" strategy where the attacker leverages the state of the filesystem. The attack proceeds in two phases:
Pre-seeding (The Pivot): The attacker must ensure a symbolic link exists in the target extraction directory. This might be achieved through a prior legitimate extraction (if the extractor allows symlinks but doesn't follow them), or via another vulnerability that allows creating symlinks (e.g., a lesser file upload bug).
exploit_dir/target_link pointing to /root/.ssh.Traversal (The Trigger): The attacker uploads a malicious ZIP file containing an entry named target_link/authorized_keys.
Execution: OpenClaw constructs the path exploit_dir/target_link/authorized_keys. The lexical check passes. The file write operation follows target_link to /root/.ssh and overwrites authorized_keys with the attacker's public key.
This vector is particularly dangerous in environments where users can install "skills" or plugins, as these often involve unpacking archives into a dedicated workspace.
The impact of this vulnerability is critical, potentially resulting in full system compromise.
~/.ssh/authorized_keys, crontabs, or application scripts (e.g., replacing index.js), an attacker can gain persistent shell access or execute arbitrary commands.The severity is mitigated slightly by the requirement for a pre-existing symlink, but in automated environments or shared hosting scenarios, this condition is often satisfiable.
The vulnerability is patched in OpenClaw version 2026.1.29 and later. The fix involves strict validation of path components and the use of safe file system flags.
Immediate Actions:
openclaw package to version 2026.1.29 or higher immediately./etc, /usr, /root).ELOOP (Too many symbolic links) or security exceptions related to path traversal, which may indicate attempted exploitation against patched systems.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Product | Affected Versions | Fixed Version |
|---|---|---|
openclaw openclaw | < 2026.1.29 | 2026.1.29 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-59 |
| Attack Vector | Network / Local |
| CVSS Score | 8.8 |
| Impact | Arbitrary File Write / RCE |
| Patch Status | Available |
| Exploit Maturity | Proof of Concept |
Improper Link Resolution Before File Access ('Link Following')
CVE-2026-48861 is a client-side HTTP request-line CRLF (Carriage Return Line Feed) injection vulnerability in the popular Elixir HTTP client library, Mint. The vulnerability permits HTTP Request Splitting and HTTP Request Smuggling when an application forwards untrusted, attacker-controlled inputs to Mint's HTTP client requests as either the HTTP request method or target. By embedding CRLF characters within these parameters, an attacker can terminate the request line prematurely, inject malicious headers, or pipeline entirely independent requests. These smuggled requests are then processed by upstream or downstream proxy servers as separate HTTP queries on the same TCP connection. While Mint version 1.7.0 introduced target validation to secure the request target, the HTTP request method parameter remained completely unvalidated. This flaw allows attackers to bypass routing filters, access restricted internal APIs, or poison HTTP caches under default configurations.
An Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) vulnerability in the Elixir Mint HTTP client allows attacker-controlled HTTP/1 servers to desynchronize response framing on shared connections due to over-lenient parsing of sign-prefixed Content-Length headers.
An allocation of resources without limits or throttling vulnerability in Elixir Mint allows an attacker-controlled HTTP/2 server to exhaust memory in a Mint client. The vulnerability is exploited by sending a HEADERS frame without the END_HEADERS flag followed by an infinite stream of CONTINUATION frames. Because the client lacks limits on the incoming header-block accumulator, the client continuously consumes memory until an out-of-memory crash occurs.
CVE-2026-48596 is an Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting, CWE-113) in the Elixir Tesla HTTP client. The flaw resides in how multipart content-type parameters are joined and serialized, enabling attackers to inject arbitrary headers or split HTTP requests when applications pass untrusted inputs to the parameters of multipart uploads.
An improper handling of highly compressed data (decompression bomb) vulnerability exists in the Elixir Tesla HTTP client when utilizing response decompression middlewares. By serving highly compressed responses or stacked content-encoding headers, a malicious server can cause arbitrary heap exhaustion, leading to a denial of service (DoS) crash in the BEAM virtual machine.
A high-severity security vulnerability in Elixir's Tesla HTTP client library (CVE-2026-48595) allows unauthenticated remote attackers to harvest sensitive credentials, including Authorization headers and cookies. The flaw resides in the 'Tesla.Middleware.FollowRedirects' component, which performs case-sensitive lookups when stripping credentials during cross-origin redirects. Because HTTP headers are case-insensitive by RFC specifications, standard canonical casing (e.g., 'Authorization') bypasses the lowercase-only blocklist, leaking tokens to untrusted external redirect destinations.