GHSA-5ghc-98wh-gwwf

Source

https://github.com/advisories/GHSA-5ghc-98wh-gwwf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5ghc-98wh-gwwf/GHSA-5ghc-98wh-gwwf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5ghc-98wh-gwwf

Aliases

CVE-2026-32020

Downstream

MINI-33j4-2hff-65wq

Published

2026-03-02T22:19:03Z

Modified

2026-03-19T22:41:21Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read

Details

Summary

The Control UI static file handler previously validated asset paths lexically and then served files with APIs that follow symbolic links. A symlink placed under the Control UI root could cause out-of-root file reads.

Affected Packages / Versions

Package: openclaw (npm)
Latest published version observed: 2026.2.21-2
Affected versions: <=2026.2.21-2
Planned fixed release version: 2026.2.22

Technical Details

The vulnerable flow was in src/gateway/control-ui.ts, where path.join(...) + string-prefix checks were followed by file reads that resolved symlinks. This allowed directory-confinement bypasses when symlinks existed inside the Control UI root.

The fix now enforces realpath containment and verifies file identity before serving Control UI assets and SPA fallback index.html.

Impact

Vulnerability type: path traversal / external file exposure via symlink following.
Primary impact: confidentiality (out-of-root file read).
Severity guidance: low in supported trusted-operator deployments; can be higher in unsupported shared-writable setups.

Fix Commit(s)

7c500ff6236fa087ec1ec88696ca9f6881e90dc5

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.22). After npm release is available, publish the advisory.

OpenClaw thanks @tdjackey for reporting.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-02T22:19:03Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2026.2.22

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5ghc-98wh-gwwf/GHSA-5ghc-98wh-gwwf.json"