GHSA-FV94-QVG8-XQPW: GHSA-fv94-qvg8-xqpw...

GHSA-fv94-qvg8-xqpw: OpenClaw SSH Sandbox Symlink Escape and Arbitrary File Access Vulnerability ID: GHSA-FV94-QVG8-XQPW CVSS Score: 8.8 Published: 2026-04-02 OpenClaw versions 2026.3.28 and earlier contain a critical symbolic link handling vulnerability within the SSH sandbox synchronization process. The framework fails to validate symbolic links before executing file uploads via the uploadDirectoryToSshTarget function. This flaw allows an attacker interacting with the AI agent to traverse dire