CVE-2026-27485
Symlink Traversal in OpenClaw Skill Packaging Causes Data Disclosure
Publication date: 2026-02-21
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.2.17 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-27485 is a security vulnerability in the OpenClaw personal AI assistant's skill packaging process. In versions 2026.2.17 and earlier, the packaging script used by skill authors improperly followed symbolic links (symlinks) when creating .skill archive files."}, {'type': 'paragraph', 'content': 'If an attacker crafts a local skill directory containing symlinks pointing to files outside the skill root, the packaging script would include the contents of those external files inside the generated .skill archive unintentionally.'}, {'type': 'paragraph', 'content': 'This vulnerability requires local execution of the packaging script on attacker-controlled skill contents and can lead to unintentional disclosure of local files from the packaging machine.'}, {'type': 'paragraph', 'content': 'The issue was fixed in version 2026.2.18 by enforcing strict rejection of any symlinks during packaging, causing the process to fail if symlinks are detected, thereby preventing inclusion of arbitrary or external files.'}] [1, 2, 3, 5]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can lead to the unintentional disclosure of local files from the machine where the skill packaging script is run. If an attacker controls the skill directory and includes symlinks to sensitive files outside the skill root, those files' contents may be embedded in the generated .skill archive."}, {'type': 'paragraph', 'content': 'The impact is limited to local workflows since the vulnerability requires local execution of the packaging script on attacker-controlled skill contents and cannot be triggered remotely.'}, {'type': 'paragraph', 'content': 'If exploited, sensitive or confidential files on the packaging machine could be exposed unintentionally to anyone who receives or inspects the crafted skill package.'}] [1, 3, 5]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to the local execution of the OpenClaw skill packaging script `package_skill.py` which improperly follows symlinks during packaging. Detection involves checking for the presence of symlinks within skill directories before packaging.
Since the vulnerability occurs during local packaging, detection can be done by scanning skill directories for symbolic links that could lead to unintended file inclusion.
- Use the command `find /path/to/skill-directory -type l` to list all symbolic links within the skill directory.
- Check the packaging process output for errors indicating symlink rejection if using a patched version (2026.2.18 or later).
There are no network-based detection commands since the vulnerability requires local execution and cannot be triggered remotely.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade OpenClaw to version 2026.2.18 or later, where the packaging script rejects any symlinks during skill packaging.
If upgrading immediately is not possible, manually ensure that no symlinks exist within skill directories before packaging by removing or replacing them.
- Audit skill directories for symlinks using `find /path/to/skill-directory -type l` and remove any found symlinks.
- Avoid running the packaging script on untrusted or attacker-controlled skill directories.
Review and follow updated packaging guidance and documentation that explicitly states symlinks are disallowed in skill packages.