This defect permits a malicious actor to craft a path that resolves to a symbolic link outside the expected repository directory. When the marketplace repository handler processes the path, the link is followed and files outside the allowed root become readable or writable. The weakness stems from insufficient validation of the repository path, which can lead to disclosure of sensitive files or compromise of the repository’s integrity.

The vulnerability affects OpenClaw version 2026.3.22 and all older releases prior to 2026.4.5. Users running those releases are at risk when they install or update marketplace repositories through the remote repository interface.

The CVSS base score of 6.0 denotes moderate severity. No EPSS value is currently available, and the vulnerability is not listed in the CISA KEV catalog. If an attacker can supply a custom symlink path to the remote marketplace handling logic—most likely via a remote request to the repository endpoint—the path traversal can be exploited to read arbitrary files on the host. The scenario requires that the attacker succeeds in submitting a crafted path; the vulnerability does not appear to allow arbitrary code execution but enables significant confidentiality and integrity risks.