CVE-2026-43570

Katalog CVE

CVSS 6.5 · Medium EPSS 0,49%

Kerentanan UNIX Symbolic Link (Symlink) Following pada openclaw. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6 advisory vendor
• https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c537f3a patch
• https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538edaeae patch
• https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marketplace-repository-path-handling advisory pihak ketiga