CVE-2026-32020
LOW
openclaw
NVD
CVSS Score
3.3
Severity
LOW
Published
Mar 19, 2026
Vendor
openclaw
Description
OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads. Attackers can place symlinks under the Control UI root directory to bypass directory confinement checks and read arbitrary files outside the intended root.