CVE-2026-43570: OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to access files outside the intended repository directory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43570?
The severity of CVE-2026-43570 is classified as medium due to its potential impact on unauthorized access.
How do I fix CVE-2026-43570?
To fix CVE-2026-43570, upgrade OpenClaw to version 2026.4.5 or later.
What type of vulnerability is CVE-2026-43570?
CVE-2026-43570 is a symlink traversal vulnerability in the handling of remote marketplace repository paths.
Who is affected by CVE-2026-43570?
All users of OpenClaw versions prior to 2026.4.5 are affected by CVE-2026-43570.
What can an attacker do with CVE-2026-43570?
An attacker exploiting CVE-2026-43570 can escape the expected repository root and potentially access unauthorized files.