OpenClaw Sandbox Boundary Bypass Vulnerability in Temporary File Handling

A sandbox boundary bypass vulnerability has been identified in OpenClaw versions prior to 2026.3.11. This vulnerability arises in the fs-bridge staged write process, where the creation and population of temporary files are not securely tied to a verified parent directory. Exploitation involves a race condition related to changes in parent-path aliases, allowing attackers to write controlled data outside the intended validated path before the final replacement step is executed.

Impact

Exploitation of this vulnerability could lead to unauthorized data being written outside of the intended directories, potentially disrupting the application's integrity and availability within the affected writable mount.

Remediation

Users are advised to upgrade to OpenClaw version 2026.3.11 or later.