CVE-2026-27670 in OpenClaw
Zusammenfassung
von MITRE • 19.03.2026
OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.