OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory.
Date: 2026-03
Affected: openclaw/openclaw
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-26317
CVE-2026-26319
CVE-2026-26320
CVE-2026-26321
CVE-2026-26322
CVE-2026-26323
CVE-2026-26324
CVE-2026-26325
CVE-2026-26326
CVE-2026-26327
CVE-2026-26328
CVE-2026-26329
CVE-2026-27486
CVE-2026-27487
CVE-2026-28392
CVE-2026-28393
CVE-2026-28451
CVE-2026-28452
CVE-2026-28453
CVE-2026-28456
CVE-2026-28463
CVE-2026-28469
CVE-2026-28476
CVE-2026-28477
CVE-2026-28480
CVE-2026-28486
CVE-2026-29606
CVE-2026-29610
CVE-2026-29611
CVE-2026-29612
CVE-2026-32060
CVE-2026-35629
CVE-2026-35667
CWE: CWE-200
CWE-22
CWE-283
CWE-284
CWE-290
CWE-306
CWE-345
CWE-352
CWE-404
CWE-427
CWE-451
CWE-639
CWE-73
CWE-770
CWE-78
CWE-863
CWE-918
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.


Mitigations:

Architectural layers (MAESTRO):