HIGH SeverityCVSS 4.07.2CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVE-2026-41364
Last updated Apr 27, 2026 · Published Apr 27, 2026
Description
OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox and overwrite files on the remote host.
Affected products
1 listed- OpenClaw:OpenClaw
Mappings
CWE
CWE-59
CAPEC
None listed.
Related
CVE® content © MITRE Corporation. Licensed under the CVE Terms of Use. Terms