OpenClaw versions prior to 2026.2.25 contain a symlink traversal flaw in the handling of browser trace and download output paths. The vulnerability allows a local attacker to create symbolic links that redirect file writes from a temporary directory managed by the application, enabling the attacker to write arbitrary data outside the intended directory. This can lead to overwriting of system or application files, compromising integrity and potentially facilitating further escalation.

OpenClaw software, all versions before 2026.2.25. The affected products are identified under the vendor name OpenClaw and product name OpenClaw. No specific sub‑versions beyond the major release are noted; the vulnerability exists in all releases preceding the 2026.2.25 update.

The vulnerability carries a CVSS score of 5.9, indicating a moderate severity. EPSS data is not available, and the issue is not listed in CISA's KEV catalog. Because the flaw requires local access and the ability to create files or symlinks in the application's temporary directory, the attack vector is inferred to be local. Once exploited, the attacker may overwrite arbitrary files, which could be used for privilege escalation or persistence, but no remote exploitation is described in the available data.