GHSA-p25h-9q54-ffvw: OpenClaw has Zip Slip path traversal in tar archive extraction

March 2, 2026

OpenClaw versions before 2026.2.14 did not sufficiently validate TAR archive entry paths during extraction. A crafted archive could use path traversal sequences (for example ../../...) to write files outside the intended destination directory (Zip Slip).

References

github.com/advisories/GHSA-p25h-9q54-ffvw
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87
github.com/openclaw/openclaw/security/advisories/GHSA-p25h-9q54-ffvw

Code Behaviors & Features

Detect and mitigate GHSA-p25h-9q54-ffvw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →