Openclaw EUVD-2026-13955

The CVSS 3.1 score of 6.5 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H indicates moderate-to-high severity weighted toward integrity and availability impact. The attack vector is local (AV:L), meaning an attacker must have shell access to the affected system; the attack complexity is high (AC:H), suggesting environmental or timing constraints that complicate exploitation; and low privileges (PR:L) are required. The integrity (I:H) and availability (A:H) impact ratings are significant, reflecting the ability to corrupt or delete arbitrary files and potentially disrupt system operation. The lack of network attack surface (S:U indicates no scope change) limits exposure in purely remote environments, but this vulnerability poses real risk in multi-tenant systems, shared hosting platforms, and container orchestration environments where local users may be untrusted. Real-world priority depends on deployment context: in single-user desktop or isolated production servers, risk is lower; in shared Linux systems or Kubernetes clusters with multiple workloads, exploitation is practical and likely automatable once an attacker gains initial local access. The high complexity rating and local-only vector somewhat temper the severity, but the guaranteed availability and integrity impact (versus just confidentiality) elevates this above purely informational disclosures.

An unprivileged local user on a shared Linux system gains access to the temporary directory where OpenClaw stores browser traces or downloads. The attacker creates a symbolic link pointing from a predictable path within OpenClaw's temp root (e.g., /tmp/openclaw-traces/output.log) to a sensitive target file outside the sandbox (e.g., /etc/cron.d/backdoor or a configuration file in another user's home directory). When OpenClaw writes trace or download data to the symlink path, the data is written to the attacker-controlled target, potentially corrupting system files, injecting malicious cron jobs, or overwriting application configuration files. The high attack complexity rating reflects the need for the attacker to predict or control the exact output path and timing, but exploitation is entirely automatable and requires no user interaction once prerequisites are met.