CVE-2026-27008: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27008 is a path traversal vulnerability in the openclaw npm package (an AI agent/skill platform) that allows authenticated administrators to write files outside the intended per-skill tools directory during skill installation. The flaw exists in the skills.install download flow, where targetDir values sourced from skill frontmatter metadata are not strictly validated against the sandbox boundary. It affects all openclaw versions prior to 2026.2.15 and was disclosed on February 18, 2026. The CVSS v3.1 base score is 6.7 (Medium), and the CVSS v4.0 base score is 6.8 (Medium) (GitHub Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path): the skills.install download handler reads targetDir from skill frontmatter (SKILL.md metadata) and uses it to determine where downloaded archive contents are extracted, without enforcing that the resolved path remains within the per-skill tools directory sandbox. An attacker-controlled targetDir value containing path traversal sequences (e.g., ../../) or absolute paths (e.g., ~/.openclaw/tools/sherpa-onnx-tts/runtime) could resolve to arbitrary filesystem locations. The fix (commit 2363e1b) enforces strict path confinement by resolving targetDir relative to the per-skill tools directory and rejecting any value that escapes it; a companion commit (b6305e9) added security-focused test coverage including traversal, symlink, and stripComponents escape scenarios (GitHub Advisory, Fix Commit, Test Commit).

Successful exploitation allows an authenticated admin to write arbitrary files to any location accessible by the openclaw process, bypassing the intended installation sandbox. This primarily threatens system integrity — an attacker could overwrite configuration files, inject malicious scripts into executable paths, or plant backdoors in other parts of the application, potentially leading to code execution in a broader system context. Confidentiality impact is low (limited read exposure), and availability is not directly affected. The changed scope (CVSS S:C) reflects that the impact can extend beyond the vulnerable component itself (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. Exploitation requires local access and high administrative privileges (the operator.admin role), significantly limiting the attack surface. The EPSS score is approximately 0.013% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Gain admin access: Obtain or already possess operator.admin credentials on a vulnerable openclaw instance (version ≤ 2026.2.14).
2. Craft a malicious skill: Create or modify a skill's SKILL.md frontmatter to include a download installer entry with a targetDir value containing path traversal sequences, for example: "targetDir": "../../../../../../tmp/evil" or an absolute path outside the tools directory.
3. Trigger skill installation: Invoke the skills.install flow for the crafted skill via the admin interface or API, causing openclaw to process the malicious targetDir without validation.
4. Write arbitrary files: The downloaded archive contents are extracted to the attacker-controlled path, allowing placement of malicious files (e.g., scripts, configuration overrides) anywhere the openclaw process has write access.
5. Achieve persistence or escalation: Depending on the target path, overwrite startup scripts, inject into application directories, or plant files that trigger code execution when accessed by other system components (GitHub Advisory, Fix Commit).

• File System: Unexpected files appearing outside the ~/.openclaw/tools/<skill-name>/ directory tree, particularly in system directories, application directories, or user home directories not associated with openclaw skills; newly created or modified files with timestamps coinciding with skill installation events.
• Logs: openclaw skill installation logs referencing targetDir values containing .., absolute paths, or ~-prefixed paths; installation events for skills not recognized as part of the standard skill catalog.
• Process: The openclaw process (Node.js) spawning tar extraction commands with -C flags pointing to directories outside the expected tools sandbox path.

Upgrade openclaw to version 2026.2.15 or later, which enforces strict path confinement for targetDir values in skill frontmatter (Release Notes, GitHub Advisory). Until patching is complete, restrict administrative access to the skills.install functionality to the minimum number of trusted users. Additionally, implement file integrity monitoring on critical system directories to detect unauthorized file modifications, and audit existing installed skills for any targetDir values that reference paths outside the per-skill tools directory.

The vulnerability was reported by security researcher @Adam55A-code and acknowledged in the official advisory and release notes. The fix was published by openclaw maintainer steipete on February 18, 2026. Tenable added detection via Nessus plugin 299798, and Red Hat tracked the CVE in their security advisory database. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking (Tenable, Red Hat).