Vulnerability Description
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | >= 2026.3.22, < 2026.4.5 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c53Patch
- https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538edPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marketThird Party Advisory
FAQ
What is CVE-2026-43570?
CVE-2026-43570 is a vulnerability with a CVSS score of 6.5 (MEDIUM). OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attac...
How severe is CVE-2026-43570?
CVE-2026-43570 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-43570?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.