Cyber Posture

CVE-2026-32013

HighPublic PoC

Published: 19 March 2026

Published
19 March 2026
Modified
23 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0004 12.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Security Summary

CVE-2026-32013, published on 2026-03-19, is a symlink traversal vulnerability (CWE-59) in OpenClaw versions prior to 2026.2.25. The flaw exists in the agents.files.get and agents.files.set methods, enabling unauthorized reading and writing of files outside the agent workspace by exploiting symlinked allowlisted files.

Attackers require low privileges (PR:L) to exploit this vulnerability remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), earning a CVSS v3.1 base score of 8.8 (C:H/I:H/A:H/S:U). Successful exploitation allows access to arbitrary host files within the gateway process permissions, potentially enabling code execution via targeted file overwrite attacks.

Mitigation is detailed in the GitHub security advisory (GHSA-fgvx-58p6-gjwc) and the patching commit (125f4071bcbc0de32e769940d07967db47f09d3d), with further analysis in the VulnCheck advisory. Security practitioners should upgrade to OpenClaw 2026.2.25 or later to address the issue.

Details

CWE(s)
CWE-59

Affected Products

openclaw
openclaw
≤ 2026.2.25

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Symlink traversal in remote file get/set methods enables exploitation of public-facing application (T1190) and arbitrary file reads from local system (T1005), with potential for code execution via overwrites.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References