CVE-2026-27670

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2

Description OpenClaw is affected by a race condition during ZIP file extraction. This allows local attackers to write files to locations outside the intended destination directory. The issue arises from a time-of-check-time-of-use race condition between path validation and file write operations. Attackers can exploit this by manipulating symlinks to redirect file writes outside the designated extraction root.

Recommendations Update OpenClaw to version 2026.3.2 or later.