{"action":"Upgrade openclaw to 2026.2.22 or later.","affected":[{"fixed":"2026.2.22","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32020"],"ecosystem":"npm","epss":0.00174,"exploited":false,"fixed_versions":["2026.2.22"],"ghsa_id":"GHSA-5ghc-98wh-gwwf","id":"tcs_01M5KF3PJZNH7ZYN4GEN7WGP9P","modified_at":"2026-03-19T22:41:21.870173Z","published_at":"2026-03-02T22:19:03Z","references":["https://osv.dev/vulnerability/GHSA-5ghc-98wh-gwwf","https://github.com/openclaw/openclaw/security/advisories/GHSA-5ghc-98wh-gwwf","https://github.com/openclaw/openclaw/commit/7c500ff6236fa087ec1ec88696ca9f6881e90dc5","https://github.com/openclaw/openclaw"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-5ghc-98wh-gwwf","url":"https://osv.dev/vulnerability/GHSA-5ghc-98wh-gwwf"}],"summary":"OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read"}