Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only `skills.install` flow, this could write files outside the intended install sandbox. Version 2026.2.15 contains a fix for the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27008 Directory Traversal Vulnerability in OpenClaw AI Assistant Prior to 2026.2.15 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27008
Post summary
OpenClaw AI Assistant is affected by a directory traversal vulnerability (CVE-2026-27008) prior to version 2026.2.15; the text provides the vulnerability type but offers no PoC, exploit code, or patch information.
⚡ New CVE Alert: CVE-2026-27008 📊 Severity: 6.8 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-27008 #CVE-2026-27008 #CVE #Medium #CyberSecurity #InfoSec https://t.co/uj4wzgfbEu
Post summary
The tweet merely announces CVE-2026-27008, stating its severity and risk level, without providing additional technical, exploit, or mitigation information.
CVE-2026-27008 OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to resolve o… https://www.cve.org/CVERecord?id=CVE-2026-27008
Post summary
CVE‑2026‑27008 reveals a flaw in OpenClaw’s download skill that mis‑handles targetDir values, affecting versions before 2026.2.15, which has been remedied in the newer release.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |