CVE-2026-27008

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27008
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27008.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27008
Aliases
Published
2026-02-19T23:23:32.275Z
Modified
2026-03-03T01:11:39.013221Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw hardened the skill download target directory validation
Details

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in download skill installation allowed targetDir values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only skills.install flow, this could write files outside the intended install sandbox. Version 2026.2.15 contains a fix for the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27008.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-73"
    ]
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea487f05c1763f170381b6fcff73b0fea0fd12d5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27008.json"