CVE-2026-22180: OpenClaw path traversal enables

CISO Take

OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass (CWE-59) in browser output handling that allows a low-privileged local attacker to write files to arbitrary filesystem locations outside the intended root directory. In AI agent deployments, this matters disproportionately to its medium CVSS score (5.3): OpenClaw operates as a computer-use agent with broad filesystem access, meaning arbitrary writes can overwrite agent configuration files, inject malicious tool definitions, or plant persistence mechanisms in cron or init paths — a risk profile compounded by the fact that OpenClaw's third-party skills ecosystem has already been weaponized to deliver credential-stealing malware (AIID #1368, AMOS Stealer, Feb 2026). Although the raw EPSS probability is low (0.0013), it ranks in the top 97th percentile across all CVEs, and exploitation requires only low privileges with no user interaction, making opportunistic abuse via compromised skill packages realistic. Patch to 2026.3.2 immediately using the reference commit (104d32bb64); if patching is blocked, containerize OpenClaw with strict read-only volume mounts and filesystem integrity monitoring on paths outside the expected write root.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

The medium CVSS base score (5.3) systematically undervalues risk in agentic AI contexts. Local exploitation with low privileges and no user interaction (AC:L/PR:L/UI:N) translates to practical exploitability via compromised or malicious skills in OpenClaw's plugin ecosystem — a vector already demonstrated in the wild (AIID #1368). The package carries 396 historical CVEs, indicating sustained code-quality debt. For organizations running OpenClaw as a computer-use or browser automation agent in privileged environments, the effective risk is HIGH due to the agent's inherent filesystem access and trust position within AI pipelines.

How does the attack unfold?

Initial Access via Malicious Skill

Adversary publishes a weaponized OpenClaw skill to ClawHub or social-engineers a user into installing it, gaining execution within the OpenClaw agent context with low user privileges.

AML.T0010.005

Path Traversal Trigger

The malicious skill instructs OpenClaw's browser output handler to write a file using a crafted path containing traversal sequences (e.g., '../../etc/cron.d/payload'), exploiting the insufficient canonical path-boundary validation.

AML.T0053

Root Boundary Escape

OpenClaw resolves the traversal path without confining it to the declared output root, writing attacker-controlled content to an arbitrary filesystem location outside the intended directory.

AML.T0107

Host Persistence / Impact

Attacker-written files (e.g., cron jobs, init scripts, modified agent configs) execute on the host or alter downstream AI pipeline behavior, achieving persistence, credential theft, or full machine compromise.

AML.T0112.000

Initial Access via Malicious Skill

Adversary publishes a weaponized OpenClaw skill to ClawHub or social-engineers a user into installing it, gaining execution within the OpenClaw agent context with low user privileges.

AML.T0010.005

Path Traversal Trigger

The malicious skill instructs OpenClaw's browser output handler to write a file using a crafted path containing traversal sequences (e.g., '../../etc/cron.d/payload'), exploiting the insufficient canonical path-boundary validation.

AML.T0053

Root Boundary Escape

OpenClaw resolves the traversal path without confining it to the declared output root, writing attacker-controlled content to an arbitrary filesystem location outside the intended directory.

AML.T0107

Host Persistence / Impact

Attacker-written files (e.g., cron jobs, init scripts, modified agent configs) execute on the host or alter downstream AI pipeline behavior, achieving persistence, credential theft, or full machine compromise.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

Upgrade to OpenClaw 2026.3.2 or apply patch commit 104d32bb64 from the upstream repository immediately.
If immediate patching is not feasible, run OpenClaw in a containerized environment with volume mounts scoped to the minimum required write paths; enforce read-only mounts for all other filesystem locations.
Deploy filesystem integrity monitoring (FIM) on sensitive paths (e.g., /etc, ~/.config, agent configuration directories) to detect unexpected writes.
Audit OpenClaw skills/plugins currently installed against known-good sources; the AIID #1368 incident confirms the skills ecosystem has been used for malware delivery.
Monitor process-level file write syscalls from OpenClaw using auditd or eBPF-based tooling; alert on writes outside declared output directories.
Check the reference vendor advisory (vulncheck.com) and GHSA-3pxq-f3cp-jmxp for any additional indicators.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0101 - Data Destruction via AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.1.2 - AI risk assessment A.8.4 - Data security in AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain trustworthiness over the AI lifecycle

OWASP LLM Top 10

LLM05 - Improper Output Handling LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-22180?

OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass (CWE-59) in browser output handling that allows a low-privileged local attacker to write files to arbitrary filesystem locations outside the intended root directory. In AI agent deployments, this matters disproportionately to its medium CVSS score (5.3): OpenClaw operates as a computer-use agent with broad filesystem access, meaning arbitrary writes can overwrite agent configuration files, inject malicious tool definitions, or plant persistence mechanisms in cron or init paths — a risk profile compounded by the fact that OpenClaw's third-party skills ecosystem has already been weaponized to deliver credential-stealing malware (AIID #1368, AMOS Stealer, Feb 2026). Although the raw EPSS probability is low (0.0013), it ranks in the top 97th percentile across all CVEs, and exploitation requires only low privileges with no user interaction, making opportunistic abuse via compromised skill packages realistic. Patch to 2026.3.2 immediately using the reference commit (104d32bb64); if patching is blocked, containerize OpenClaw with strict read-only volume mounts and filesystem integrity monitoring on paths outside the expected write root.

Is CVE-2026-22180 actively exploited?

No confirmed active exploitation of CVE-2026-22180 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22180?

1. Upgrade to OpenClaw 2026.3.2 or apply patch commit 104d32bb64 from the upstream repository immediately. 2. If immediate patching is not feasible, run OpenClaw in a containerized environment with volume mounts scoped to the minimum required write paths; enforce read-only mounts for all other filesystem locations. 3. Deploy filesystem integrity monitoring (FIM) on sensitive paths (e.g., /etc, ~/.config, agent configuration directories) to detect unexpected writes. 4. Audit OpenClaw skills/plugins currently installed against known-good sources; the AIID #1368 incident confirms the skills ecosystem has been used for malware delivery. 5. Monitor process-level file write syscalls from OpenClaw using auditd or eBPF-based tooling; alert on writes outside declared output directories. 6. Check the reference vendor advisory (vulncheck.com) and GHSA-3pxq-f3cp-jmxp for any additional indicators.

What systems are affected by CVE-2026-22180?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, browser automation agents, computer-use agents, multi-agent orchestration pipelines, local AI agent deployments.

What is the CVSS score for CVE-2026-22180?

CVE-2026-22180 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksbrowser automation agentscomputer-use agentsmulti-agent orchestration pipelineslocal AI agent deployments

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0101 Data Destruction via AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.1.2, A.8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directories. Attackers can exploit insufficient canonical path-boundary validation in file write operations to escape root-bound restrictions and write files to arbitrary locations.

Exploitation Scenario

An adversary publishes a malicious OpenClaw skill to ClawHub (consistent with the AIID #1368 attack pattern) that, when invoked, instructs OpenClaw's browser output handler to download and 'save' a crafted file with a path containing traversal sequences such as '../../etc/cron.d/backdoor'. Because canonical path-boundary validation is insufficient, OpenClaw resolves the path without confining it to the declared output root and writes the file to /etc/cron.d/, scheduling a reverse shell or credential-harvesting payload. The attacker requires only that a low-privileged user has installed and invoked the malicious skill — no elevated permissions, no user confirmation dialog, no UI interaction — and achieves OS-level persistence on the host running the agent.

Weaknesses (CWE)

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-59 — Improper Link Resolution Before File Access ('Link Following'): The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.