GHSA-5GHC-98WH-GWWF

Vulnerability from github – Published: 2026-03-02 22:19 – Updated: 2026-03-19 22:23
VLAI
Summary
OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read
Details

Summary

The Control UI static file handler previously validated asset paths lexically and then served files with APIs that follow symbolic links. A symlink placed under the Control UI root could cause out-of-root file reads.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published version observed: 2026.2.21-2
  • Affected versions: <=2026.2.21-2
  • Planned fixed release version: 2026.2.22

Technical Details

The vulnerable flow was in src/gateway/control-ui.ts, where path.join(...) + string-prefix checks were followed by file reads that resolved symlinks. This allowed directory-confinement bypasses when symlinks existed inside the Control UI root.

The fix now enforces realpath containment and verifies file identity before serving Control UI assets and SPA fallback index.html.

Impact

  • Vulnerability type: path traversal / external file exposure via symlink following.
  • Primary impact: confidentiality (out-of-root file read).
  • Severity guidance: low in supported trusted-operator deployments; can be higher in unsupported shared-writable setups.

Fix Commit(s)

  • 7c500ff6236fa087ec1ec88696ca9f6881e90dc5

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.22). After npm release is available, publish the advisory.

OpenClaw thanks @tdjackey for reporting.

Severity
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32020"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-02T22:19:03Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\nThe Control UI static file handler previously validated asset paths lexically and then served files with APIs that follow symbolic links. A symlink placed under the Control UI root could cause out-of-root file reads.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published version observed: `2026.2.21-2`\n- Affected versions: `\u003c=2026.2.21-2`\n- Planned fixed release version: `2026.2.22`\n\n### Technical Details\nThe vulnerable flow was in `src/gateway/control-ui.ts`, where `path.join(...)` + string-prefix checks were followed by file reads that resolved symlinks. This allowed directory-confinement bypasses when symlinks existed inside the Control UI root.\n\nThe fix now enforces realpath containment and verifies file identity before serving Control UI assets and SPA fallback `index.html`.\n\n### Impact\n- Vulnerability type: path traversal / external file exposure via symlink following.\n- Primary impact: confidentiality (out-of-root file read).\n- Severity guidance: low in supported trusted-operator deployments; can be higher in unsupported shared-writable setups.\n\n### Fix Commit(s)\n- `7c500ff6236fa087ec1ec88696ca9f6881e90dc5`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.22`). After npm release is available, publish the advisory.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-5ghc-98wh-gwwf",
  "modified": "2026-03-19T22:23:09Z",
  "published": "2026-03-02T22:19:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5ghc-98wh-gwwf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/7c500ff6236fa087ec1ec88696ca9f6881e90dc5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw\u0027s Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.