The flaw is a time‑of‑check/time‑of‑use race condition in the OpenShell sandbox filesystem of OpenClaw. When writing a file the code verifies the intended location but does not prevent a symlink from being swapped in the interim. An attacker can therefore redirect the write operation to any path on the host, allowing modification of files outside the sandbox. This is a CWE‑367 weakness and can lead to unauthorized file writes, privilege escalation or system compromise.

All releases of OpenClaw before 2026.4.22 are affected; any deployment using the OpenShell sandbox in those versions is vulnerable. No additional vendor or product subdivisions are listed.

The CVSS base score is 6, indicating medium severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an adversary can supply data that triggers the vulnerable write path from a network or untrusted source. Exploitation would allow the attacker to write arbitrary files outside the intended mount root, potentially compromising the host system.