CVE-2026-27670: Openclaw

Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.

Affected products

• Openclaw Openclaw: before 2026.3.2 (fixed in 2026.3.2)

Published 2026-03-19. Last modified 2026-06-17.