CVE-2026-31990: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-31990 is a symlink traversal vulnerability in the stageSandboxMedia function of OpenClaw, an npm package, that allows local low-privilege attackers to overwrite arbitrary files on the host system outside the intended sandbox workspace. All versions prior to 2026.3.2 are affected. The vulnerability was published on March 19, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). The stageSandboxMedia function validated source paths but performed destination file writes using a direct copy path (fs.copyFile) without enforcing destination boundary or alias checks. This meant that if a symlink existed anywhere along the destination path under media/inbound within the sandbox workspace, the write operation would follow the symlink and write to the resolved target — potentially outside the sandbox root. The fix replaces direct copy operations with root-scoped safe write primitives (writeFileWithinRoot and readLocalFileSafely) for both local and SCP-staged attachments, and routes remote files through a temporary directory before applying the same boundary-safe write (GitHub Advisory, Fix Commit).

An attacker with local access and low privileges can exploit this vulnerability to overwrite arbitrary files on the host system by placing crafted symlinks in the media/inbound directory of the sandbox workspace. This breaks sandbox isolation and can result in unauthorized modification of critical system files, configuration files, or other sensitive data, compromising both system integrity and availability. There is no confidentiality impact, but the ability to overwrite arbitrary files could be leveraged for privilege escalation or denial of service (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012%, indicating a very low probability of exploitation in the near term. The vulnerability requires local access with low privileges and is not remotely exploitable. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher tdjackey (GitHub Advisory, Feedly).

1. Gain local access: Obtain a local account with low privileges on a system running OpenClaw prior to version 2026.3.2.
2. Identify the sandbox workspace: Locate the sandbox workspace directory, typically at a path such as ~/.openclaw/sandboxes/<session>/.
3. Create the target symlink chain: Within the sandbox workspace, create a symlink at the media directory level pointing to a directory outside the sandbox (e.g., ln -s /etc sandbox_dir/media). Optionally, create a further symlink within the resolved directory pointing to a specific victim file (e.g., ln -s /etc/cron.d/target sandbox_dir/media/inbound/<filename>).
4. Trigger media staging: Place or cause a media file to be placed in the media/inbound inbound directory (e.g., ~/.openclaw/media/inbound/payload.txt) and trigger the stageSandboxMedia function, for example by sending a message with an attachment through the OpenClaw agent.
5. Overwrite target file: The unpatched stageSandboxMedia function follows the symlink chain during the destination write, overwriting the victim file outside the sandbox with the attacker-controlled payload content (GitHub Advisory, Fix Commit).

• File System: Unexpected symlinks present in the sandbox workspace media/ or media/inbound/ directories pointing to paths outside the sandbox root; unexpected modification timestamps on host system files (e.g., in /etc, /var, or user home directories) coinciding with OpenClaw media staging activity.
• Logs: OpenClaw application logs showing stageSandboxMedia operations completing successfully for sessions where the destination resolved to a path outside the expected workspace boundary; file system audit logs (e.g., auditd) recording write events to sensitive paths by the OpenClaw process.
• Process: The OpenClaw Node.js process performing file write operations to directories outside its expected workspace, observable via process-level file access monitoring tools such as inotifywait or fanotify.

Users should upgrade OpenClaw (npm package) to version 2026.3.2 or later, which routes all sandbox media staging writes through root-scoped safe write primitives that enforce destination boundary checks and prevent symlink traversal. As an interim measure, restrict local system access to accounts that run OpenClaw, apply the principle of least privilege, and implement file system monitoring to detect suspicious symlink creation in sandbox media/inbound directories. No configuration-only workaround is available that fully mitigates the vulnerability without upgrading (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher tdjackey and acknowledged by the OpenClaw maintainer (steipete) in the GitHub Security Advisory. Coverage was picked up by automated vulnerability tracking services including RedPacket Security, VulnDB, INCIBE-CERT, and CVEFeed shortly after disclosure. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregation (GitHub Advisory).