CVE-2026-32060

Description: Patch text supplied to the apply_patch tool flows through parsePatchText() into hunk.path and resolvePatchPath(). That function branches on whether sandboxRoot is configured: when it is, assertSandboxPath() blocks traversal correctly; when it is not, which is the default, resolvePathFromCwd() accepts absolute paths and ../ segments and hands the result to fs.writeFile and fs.rm with no confinement.

if (hunk.kind === "add") {
  const target = await resolvePatchPath(hunk.path, options);
  await ensureDir(target.resolved);
  await fs.writeFile(target.resolved, hunk.contents, "utf8");
}
if (hunk.kind === "delete") {
  const target = await resolvePatchPath(hunk.path, options);
  await fs.rm(target.resolved);
}

What makes this one worth reading on its own is the reachability. The sink is only reachable through LLM-mediated tool execution, so the model's safety guardrails are the sole runtime control standing in front of it, and those guardrails fall to fabricated conversation history injected through the API. A classic CWE-22 sitting behind an LLM guardrail bypass. Affects openclaw through 2026.2.13.

Impact: Arbitrary file write and delete outside the workspace.

Advisory published 2026-02-19, separately from the other six. The 8.7 recorded here is the CVSS v4.0 score published with the advisory; its v3.1 score is 8.8.