The vulnerability is a symlink traversal flaw in the stageSandboxMedia function, which allows write operations to follow symbolic links outside the intended sandbox. This results in arbitrary file write, enabling an attacker to overwrite critical files on the host system. The weakness aligns with CWE-59, representing a path traversal/dir traversal flaw that can compromise integrity and availability of system files.

Affected product: OpenClaw (OpenClaw:OpenClaw). Vulnerable versions are all releases prior to 2026.3.2. No additional version details were provided.

The CVSS score of 6.9 indicates a medium to high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the media/inbound directory, likely through local filesystem privileges or by uploading crafted symlinks if the application permits. The likely attack vector is local, though remote exploitation could be possible if the web interface allows user uploads that end up in that directory.