Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
system.run env override sanitization allowed dangerous override-only helper-command pivots to reach subprocesses. A caller who could invoke system.run with env overrides could bypass allowlist/approval intent by steering an allowlisted tool through helper-command or config-loading environment variables such as GITSSHCOMMAND, editor/pager hooks, and GITCONFIG / NPMCONFIG. Affected Packages / Versions - Package: openclaw (npm) - Latest published vulnerable version: 2026.3.2 - Affected range: <= 2026.3.2 - Patched in: 2026.3.7 Details Before the fix, src/infra/host-env-security.ts blocked only a narrow set of override-only environment variables. Dangerous request-scoped overrides such as GITSSHCOMMAND and prefix families such as GITCONFIG and NPMCONFIG could still survive sanitizeSystemRunEnvOverrides(...) / sanitizeHostExecEnv(...) and reach the spawned process. That mattered for system.run allowlist and approval flows because approval evaluation was tied to the reviewed…
Recommended action: Upgrade to 2026.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw's hooks HTTP handler counted hook authentication failures before rejecting unsupported HTTP methods. An unauthenticated client could send repeated non-POST requests (for example GET) with an invalid token to consume the hook auth failure budget and trigger the temporary lockout window for that client key. The fix moves the hook method gate ahead of auth-failure accounting so unsupported methods return 405 Method Not Allowed without incrementing the hook auth limiter. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.3.2 - Patched version: 2026.3.7 - Latest published npm version at patch time: 2026.3.2 Impact An unauthenticated network client that could reach /hooks/ could temporarily lock out legitimate webhook delivery when requests collapsed to the same hook auth client key, such as shared proxy or NAT topologies. Impact is limited to temporary availability loss for hook-triggered wake or automation delivery. Fix Commit(s) -…
Recommended action: Upgrade to 2026.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw's macOS Dashboard flow exposed Gateway authentication material to browser-controlled surfaces. Before the fix, the macOS app appended the shared Gateway token and password to the Dashboard URL query string when opening the Control UI in the browser. The Control UI then imported the token and persisted it into browser localStorage under openclaw.control.settings.v1. This expanded exposure of reusable Gateway admin credentials into browser address-bar/query surfaces and persistent script-readable storage. Affected Packages / Versions - Package: openclaw (npm) - Latest published version verified vulnerable: 2026.3.2 - Affected range: <= 2026.3.2 - Patched version: = 2026.3.7 Impact An attacker with access to browser-controlled surfaces or persistent browser storage could recover a valid Gateway admin token and reuse it against the OpenClaw management interface. The exposure chain was: 1. macOS Open Dashboard constructed a URL with auth material. 2. The browser received that…
Recommended action: Upgrade to 2026.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
BlueBubbles is an optional OpenClaw channel plugin. A configuration-sensitive access-control mismatch allowed DM senders to be treated as authorized when dmPolicy was pairing or allowlist and allowFrom was empty/unset. Severity Rationale (Medium) Severity is set to medium because: - this affects an optional plugin, not core messaging surfaces; - many deployments use owner-controlled/private BlueBubbles identities with limited external reachability; - practical exploitability depends on an untrusted sender being able to reach that specific BlueBubbles account identifier. In typical personal/self-hosted BlueBubbles setups, the mapped Apple identity is single-owner and not broadly reachable, so this is usually low practical risk. Risk is higher in deployments where the identifier is publicly reachable and/or agent tool permissions are broad. Technical Details 1. BlueBubbles DM policy defaults to pairing (dmPolicy ?? "pairing"). 2. Effective allowlist can be empty…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malicious or compromised MCP (Model Context Protocol) tool server can exfiltrate arbitrary local files from the host system by injecting MEDIA: directives into tool result text content. OpenClaw's tool result processing pipeline extracts file paths from MEDIA: tokens without source-level validation, passes them through a localRoots allowlist check that includes os.tmpdir() by default (covering /tmp on Linux/macOS and %TEMP% on Windows), and then reads and delivers the file contents to external messaging channels such as Discord, Slack, Telegram, and WhatsApp. Affected Component OpenClaw (all versions up to and including latest as of 2026-02-19) Vulnerability Details Root Cause The vulnerability exists across multiple files in the media processing pipeline: 1. Unvalidated extraction (src/agents/pi-embedded-subscribe.tools.ts, lines 143-202): extractToolResultMediaPaths() parses MEDIA: tokens from MCP tool result text content blocks using a regex. It accepts any file path…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In certain workspace-restricted configurations, OpenClaw could follow hardlink aliases inside the workspace that reference files outside the workspace boundary. By default, tools.fs.workspaceOnly is off. This primarily affects deployments that intentionally enable workspace-only filesystem restrictions (and workspace-only applypatch checks). Impact - Confidentiality: out-of-workspace files could be read through in-workspace hardlink aliases. - Integrity: out-of-workspace files could be modified through in-workspace hardlink aliases. Affected Packages / Versions - Package: openclaw (npm) - Latest published version at triage time: 2026.2.24 - Affected range: <= 2026.2.24 - Planned patched version: 2026.2.25 Fix Commit(s) - 04d91d0319b82fd4de91ed05e9fc5219ff2ab64e (main) Remediation OpenClaw now rejects hardlinked final-file aliases during workspace boundary validation for: - workspace-only path checks (read / write / edit) - workspace-only applypatch read/write paths - sandbox…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ZDI-CAN-29311: OpenClaw Canvas Authentication Bypass Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: OpenClaw - OpenClaw -- VULNERABILITY DETAILS ------------------------ Version tested: openclaw 2026.2.17 Platform tested: macOS 26.3 --- Analysis Description The OpenClaw gateway's authorizeCanvasRequest() function implements an IP-based authentication fallback for canvas endpoints (/openclaw/a2ui/, /openclaw/canvas/, /openclaw/ws). When a WebSocket client authenticates from a private IP address, ALL subsequent HTTP requests from that same IP are granted canvas access without requiring their own authentication token. In environments where multiple clients share a single IP address ��� corporate NAT, VPN concentrators, Kubernetes clusters, Docker host-mode networking ��� an unauthenticated attacker on the same network is granted full canvas access by virtue of sharing an…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenClaw, the sandboxed image tool did not honor tools.fs.workspaceOnly=true for mounted paths resolved by the sandbox FS bridge. This allowed reading out-of-workspace mounted images (for example /agent/) and forwarding those bytes to vision model providers. Impact Sandbox boundary bypass with confidentiality impact. In affected versions, read/write/edit respected workspace-only guardrails, but image could still load mounted out-of-workspace files and exfiltrate them via model requests. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.22-2 - Patched versions: = 2026.2.23 (released) - Latest published npm at triage time: 2026.2.22-2 Technical Details workspaceOnly was enforced in sandbox file tools and applypatch, but not propagated/enforced for image sandbox path resolution. The fix threads workspaceOnly into image-tool construction and asserts sandbox-root containment before loading media bytes. Fix Commit(s) -…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
isPrivateIpv4() in bundled SSRF guard code missed several IPv4 special-use/non-global ranges, so webfetch could allow targets that should be blocked by SSRF policy. Affected Packages / Versions - Package: openclaw (npm) - Latest published affected version: 2026.2.21-2 (published 2026-02-21) - Structured vulnerable range: <= 2026.2.21-2 - Planned patched version (pre-set): = 2026.2.22 Impact Low severity. Exploitation requires network reachability to the relevant special-use ranges and a request path that reaches webfetch URL fetching. Technical Details Affected releases used narrow IPv4 private-range checks that omitted multiple RFC special-use/non-global ranges. This allowed requests such as http://198.18.0.1/... through SSRF validation in affected releases. Follow-up hardening consolidates local-host/tailnet range checks so gateway/browser/tailnet paths share one canonical IP classification flow. Fix Commit(s) - 71bd15bb4294d3d1b54386064d69cd0f5f731bd8 -…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 data: URL in gateway responses. Impact - Confidentiality impact: local file read in the gateway process context. - Exfiltration path: agents.list can return the resulting avatarUrl payload. Affected Components - src/gateway/session-utils.ts (resolveIdentityAvatarUrl) Affected Packages / Versions - Package: openclaw (npm) - Introduced: v2026.1.21 - Affected published versions: <= 2026.2.21-2 - Planned patched version: 2026.2.22 Remediation - Resolve workspace and avatar paths with realpath and enforce realpath containment. - Open files with ONOFOLLOW when available. - Compare pre-open and opened file identity (dev/ino) to block swap races. - Add regression tests for outside-workspace symlink rejection and in-workspace symlink allowance. Fix Commit(s) - 3d0337504349954237d09e4d957df5cb844d5e77 OpenClaw thanks @aether-ai-agent for reporting.
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In certain elevated-mode configurations, tools.elevated.allowFrom accepted broader identity signals than intended. The fix tightens matching to sender-scoped identity by default and makes mutable metadata matching explicit. Context OpenClaw is commonly used in 1:1 chats or trusted group chats. In that intended model, this issue is best treated as authorization hardening / defense-in-depth for elevated sender approval. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage: 2026.2.21-2 - Affected versions: <= 2026.2.21-2 - Planned patched version (pre-set for publish-ready advisory): 2026.2.22 Details Elevated sender authorization now matches sender-scoped identity values only by default (SenderId, From, SenderE164) and no longer considers recipient routing fields such as ctx.To. Mutable sender metadata (SenderName, SenderUsername, SenderTag) now requires explicit allowlist prefixes (name:, username:, tag:). Explicit identity prefixes…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw had account-scope gaps in pairing-store access for DM pairing policy, which could let a pairing approval from one account authorize the same sender on another account in multi-account setups. Impact This is an authorization-boundary weakness in multi-account channel deployments. A sender approved in one account could be accepted in another account before explicit approval there. Affected Packages / Versions - Package: openclaw (npm) - Latest published version affected: 2026.2.25 - Vulnerable range: <= 2026.2.25 - Patched version (planned next release): = 2026.2.26 Fix OpenClaw now enforces account-scoped pairing reads/writes consistently across core and extension message channels, with stricter runtime/SDK helpers and shared policy wiring to prevent cross-account pairing bleed. Fix Commit(s) - a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf - bce643a0bd145d3e9cb55400af33bd1b85baeb02 Release Process Note patchedversions is pre-set to the planned next release (2026.2.26).…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw's SSRF hostname/IP guard did not detect ISATAP embedded IPv4 addresses (...:5efe:w.x.y.z). A crafted URL containing an ISATAP IPv6 literal could embed a private IPv4 target (for example loopback) and bypass private-address filtering in URL-fetching paths. Severity Assessment Rated medium: the bug weakens SSRF protections in URL fetch flows, but impact depends on reaching a URL-fetching path with attacker-controlled input and is generally constrained to internal network access attempts. Affected Packages / Versions - Package: openclaw (npm) - Affected: =2026.1.20 <=2026.2.17 - Latest published at patch time: 2026.2.17 - Patched release: 2026.2.19 Security Policy Context Per SECURITY.md, OpenClaw's web/gateway surface is intended for local use by default, public internet exposure is out-of-scope, and prompt-injection reports are out-of-scope for bounty handling. This advisory tracks a core SSRF-guard bypass in fetch protections. Impact This can permit SSRF-style access…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In shared Slack workspace deployments that rely on sender restrictions (allowFrom, DM policy, or channel user allowlists), some interactive callbacks (blockaction, viewsubmission, viewclosed) could be accepted before full sender authorization checks. In that scenario, an unauthorized workspace member could enqueue system-event text into an active session. This issue did not provide unauthenticated access, cross-gateway isolation bypass, or host-level privilege escalation by itself. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <= 2026.2.24 - Patched version: 2026.2.25 (planned next npm release) Fix Commit(s) - ce8c67c314b93f570f53c2a9abc124e1e3a54715 Release Process Note patchedversions is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25. Trust Model Scope Note OpenClaw does not support adversarial multi-user isolation on a single shared gateway instance. The supported model is one trust boundary per gateway…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Concurrent updateRegistry/removeRegistryEntry operations for sandbox containers and browsers could lose updates or resurrect removed entries under race conditions. The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, so concurrent registry updates could produce stale snapshots and overwrite each other. That desyncs sandbox state and can affect sandbox list, sandbox prune, and sandbox recreate --all behavior. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.17 - Patched versions: 2026.2.18 Fix Commit(s) - cc29be8c9 OpenClaw thanks @kexinoh for reporting.
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A client authenticated with a shared gateway token could connect as role=node without device identity/pairing, then call node.event to trigger agent.request and voice.transcript flows. Affected Packages / Versions - Package: npm openclaw - Affected versions: <= 2026.2.21-2 - Patched version: 2026.2.22 (planned next release) Details The WebSocket connect path allowed device-less bypass whenever shared auth succeeded. That bypass did not restrict role, so a client could claim role=node with no device identity and still pass handshake auth. Because node.event is node-role allowed, this enabled unauthorized node event injection into agent-trigger flows. Impact Unauthorized node.event injection can trigger agent execution and voice transcript flows for clients that only hold the shared gateway token, without node device pairing. Remediation Upgrade to 2026.2.22 (or newer) once published. The fix requires device identity for role=node connects, even when shared-token auth succeeds.…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
commands.allowFrom is documented as a sender authorization allowlist for commands/directives, but command authorization could include ctx.From (conversation identity) as a sender candidate. When commands.allowFrom contained conversation-like identifiers (for example Discord channel:<id or WhatsApp group JIDs), command/directive authorization could be granted to participants in that conversation instead of only the intended sender identity. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.22-2 - Patched version: 2026.2.23 (released) Details Root cause: resolveSenderCandidates() in src/auto-reply/command-auth.ts always included ctx.From in candidate evaluation used by commands.allowFrom authorization checks. ctx.From is sender-like in some direct-message contexts, but conversation-like in channel/group/thread contexts. This mixed principal handling allowed conversation identifiers to satisfy sender-only authorization. Impact In affected…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Windows, the Lobster extension previously retried certain spawn failures (ENOENT/EINVAL) with shell: true for wrapper compatibility. In that fallback path, tool-provided arguments could be interpreted by cmd.exe if fallback was triggered. Affected Packages / Versions - Package: openclaw (npm) - Latest published version at triage: 2026.2.17 - Affected range: = 2026.1.21 <= 2026.2.17 - Patched version: 2026.2.19 (pre-set for next release) Fix The Windows shell fallback was removed. Wrapper compatibility is preserved by resolving .cmd/.bat shims to a concrete Node entrypoint (or executable) and executing with explicit argv (no shell). If a safe entrypoint cannot be resolved, execution now fails closed with a guided error. Fix Commit(s) - ba7be018da354ea9f803ed356d20464df0437916 Severity Context This issue requires Windows plus fallback-triggering conditions, and argument control through a local operator-defined workflow. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing group-sender authorization check in the Zalo plugin allowed unauthorized GROUP messages to enter agent dispatch paths in configurations intended to restrict group traffic. Impact When Zalo group handling was configured with allowlist-style controls, a sender not present in the intended group allowlist could still trigger agent processing through the GROUP message path. Root Cause Group access checks were not consistently enforced before dispatch for Zalo GROUP messages. The fix adds explicit runtime group-policy evaluation (groupPolicy, groupAllowFrom, fallback to allowFrom) and fail-closed behavior for missing provider config. Affected Packages / Versions - Package: openclaw (npm) - Latest published vulnerable version: 2026.2.23 (as of 2026-02-24) - Affected range: <= 2026.2.23 - Planned patched version: 2026.2.24 Fix Commit(s) - b4010a0b627025c809c0e5dbdbd4770f3bc59ef8 OpenClaw thanks @tdjackey for reporting. Publication Update (2026-02-25) openclaw@2026.2.24 is published…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This advisory tracks a defense-in-depth hardening for canvas routes. In mixed-trust or network-visible deployments, prior canvas auth/fallback behavior could broaden access beyond intended boundaries. Deployment Context OpenClaw’s default model is trusted host + loopback-first access. Some operators intentionally expose canvas routes on LAN/tailnet. This update is aimed at those broader deployment patterns. What Changed - Require explicit token or session-capability authorization for canvas routes. - Remove shared-IP fallback paths for canvas access. - Tighten bind/fallback behavior to fail closed. Impact Risk was highest in non-loopback or mixed-trust environments. In strict single-operator trusted-host setups, practical exposure is lower. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable: <= 2026.2.19-2 - Patched: 2026.2.21 (next release target) Fix Commit(s) - c45f3c5b004c8d63dc0e282e2176f8c9355d24f1 - 08a7967936cfc0b2af6b27ec1f9272542648ad6c Thanks…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
system.run exec allowlist analysis treated wrapper binaries as the effective executable and did not fully unwrap env/shell-dispatch wrappers. This allowed wrapper-smuggled payloads (for example env bash -lc ...) to satisfy an allowlist entry for the wrapper while executing non-allowlisted commands. Impact On affected versions, an actor who can trigger system.run requests under an allowlist policy could bypass intended allowlist restrictions by routing execution through wrapper binaries. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.21-2 - Patched in next release: 2026.2.22 (pre-set below so publish can happen immediately after npm release) Fix Commit(s) - 2b63592be57782c8946e521bc81286933f0f99c7 Release Process Note patchedversions is pre-set to the planned next release (= 2026.2.22). After npm 2026.2.22 is published, this advisory can be published directly without further metadata edits. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
channels..groups..toolsBySender could match a privileged sender policy using a colliding mutable identity value (for example senderName or senderUsername) when deployments used untyped keys. The fix introduces explicit typed sender keys (id:, e164:, username:, name:), keeps legacy untyped keys on a deprecated ID-only path, and adds regression coverage to prevent cross-identifier collisions. Affected Packages / Versions - Package: npm openclaw - Affected versions: <= 2026.2.21-2 - Latest published npm version at triage time (February 22, 2026): 2026.2.21-2 - Patched version (planned next release): 2026.2.22 Impact This is a sender-authorization bypass in group tool policy matching for deployments that use toolsBySender with untyped keys. Under those conditions, an attacker could inherit stronger tool permissions intended for another sender if they can force an identifier collision. Fix Commit(s) - 5547a2275cb69413af3b62c795b93214fe913b57 Release Process Note patchedversions is…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.24 (latest published at patch time) - Fixed: 2026.2.25 Details In the affected flow (src/signal/monitor/event-handler.ts), reaction-only handling could return after enqueueSystemEvent(...) before DM/group authorization checks were evaluated for that sender. This behavior was limited to reaction-only inbound events with reaction notifications enabled. In that case, a sender not authorized for normal DM flow could still queue a Signal reaction status line for that session. The fix applies shared DM/group access checks before reaction notification enqueue. Pairing behavior for normal DM messages is unchanged. Impact - Limited to Signal reaction-only inbound events. - Could add an unauthorized reaction status line to agent context for affected sessions. - Did…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw up to and including 2026.2.23 (latest npm release as of February 24, 2026), sandbox bind-source validation could be bypassed when a bind source used a symlinked parent plus a non-existent leaf path. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.23 - Patched: = 2026.2.24 (planned next release) Root Cause validateBindMounts previously relied on full-path realpath only when the full source path already existed. For missing-leaf paths, parent symlink traversal was not fully canonicalized before allowed-root and blocked-path checks. Security Impact A source path that looked inside an allowed root could resolve outside that root (including blocked runtime paths) once the missing leaf was created, weakening sandbox bind-source boundary enforcement. Fix The validation path now canonicalizes through the nearest existing ancestor, then always re-checks the canonical path against both: - allowed source roots - blocked runtime paths Verification…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage time: 2026.2.21-2 - Affected versions: <= 2026.2.21-2 - Planned patched version for next release: 2026.2.22 Technical Details The vulnerable path was in src/infra/archive.ts ZIP extraction logic. Output-path checks were lexical, but writes could still traverse an existing symlink in destination path segments. The fix blocks this by: - rejecting symlink traversal in destination path segments, - validating resolved destination paths remain inside the extraction root, - using no-follow file opens for ZIP output writes where supported, - adding a regression test for pre-seeded destination symlink traversal. Impact - Type: Arbitrary file write outside extraction root via symlink traversal during ZIP extraction. -…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.