GHSA-FV94-QVG8-XQPW: GHSA-fv94-qvg8-xqpw: OpenClaw SSH Sandbox Symlink Escape and Arbitrary File Access

GHSA-fv94-qvg8-xqpw: OpenClaw SSH Sandbox Symlink Escape and Arbitrary File Access Vulnerability ID: GHSA-FV94-QVG8-XQPW CVSS Score: 8.8 Published: 2026-04-02 OpenClaw versions 2026.3.28 and earlier contain a critical symbolic link handling vulnerability within the SSH sandbox synchronization process. The framework fails to validate symbolic links before executing file uploads via the uploadDirectoryToSshTarget function. This flaw allows an attacker interacting with the AI agent to traverse directory boundaries, resulting in arbitrary file reads from the local system or arbitrary file writes to the remote sandbox host. TL;DR A symlink validation failure in OpenClaw allows an AI agent to read arbitrary local files or write to arbitrary remote files during SSH sandbox synchronization, leading to sandbox escape. ⚠️ Exploit Status: POC Technical Details CWE ID: CWE-61, CWE-59 Attack Vector: Network / AI Prompt Injection CVSS v3.1 Score: 8.8 (High) Impact: Arbitrary File Read, Arbitrary Fil