Medium
OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths
Type: advisorySources: OSV
OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41383
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:41 UTC · Revision 1
Source evidence
OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths
core-osv · Original sourcePublished 28 Apr 2026, 18:09 UTC
OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data.
osv:CVE-2026-41383
Complete source record
{
"id": "195f1af6af67ae08ffceb3c449c0a362b7cbdc3e22400ebcd9d74f68b8645b6a",
"url": "https://osv.dev/vulnerability/CVE-2026-41383",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths",
"summary": "OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data.",
"evidence": "osv:CVE-2026-41383",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-41383",
"aliases": [
"CVE-2026-41383",
"GHSA-m34q-h93w-vg5x"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openclaw/openclaw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d74a12264aa5fb0598605e8f04e1864b7239ddd5"
},
{
"fixed": "b21c9840c2e38f4bb338d031511b479d5f07ca25"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2026.4.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "b21c9840c2e38f4bb338d031511b479d5f07ca25"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2026.4.1",
"v2026.4.1-beta.1",
"v2026.3.31",
"v2026.3.31-beta.1",
"v2026.3.28",
"v2026.3.28-beta.1",
"v2026.3.24",
"v2026.3.24-beta.2",
"v2026.3.24-beta.1",
"v2026.3.23-2",
"v2026.3.23",
"v2026.3.23-beta.1",
"v2026.3.22",
"v2026.3.22-beta.1",
"v2026.3.13-1",
"v2026.3.13",
"v2026.3.12",
"v2026.3.11",
"v2026.3.11-beta.1",
"v2026.3.8",
"v2026.3.8-beta.1",
"v2026.3.7",
"v2026.3.7-beta.1",
"v2026.3.2-beta.1",
"v2026.3.2",
"v2026.3.1",
"v2026.2.26",
"v2026.2.26-beta.1",
"v2026.2.25",
"v2026.2.25-beta.1",
"v2026.2.24",
"v2026.2.24-beta.1",
"v2026.2.23",
"v2026.2.23-beta.1",
"v2026.2.22",
"v2026.2.22-beta.1",
"v2026.2.21",
"v2026.2.21-beta.1",
"v2026.2.19-beta.1",
"v2026.2.19",
"v2026.2.17",
"v2026.2.15-beta.1",
"v2026.2.14",
"v2026.2.13",
"v2026.2.12",
"v2026.2.9",
"v2026.2.6-3",
"v2026.2.6-2",
"v2026.2.6-1",
"v2026.2.6",
"v2026.2.3",
"v2026.2.2",
"v2026.2.1",
"v2026.1.30",
"v2026.1.29",
"v2026.1.24-1",
"v2026.1.24",
"v2026.1.23",
"v2026.1.22",
"v2026.1.21",
"v2026.1.20",
"v2026.1.16-2",
"v2026.1.15",
"v2026.1.14-1",
"v2026.1.13",
"v2026.1.12-2",
"v2026.1.12",
"v2026.1.11-3",
"v2026.1.11-2",
"v2026.1.11-1",
"v2026.1.11",
"v2026.1.10",
"v2026.1.9",
"v2026.1.8",
"v2026.1.5-3",
"v2026.1.5-2",
"v2026.1.5-1",
"v2026.1.5",
"v2.0.0-beta5",
"v2.0.0-beta4",
"v2.0.0-beta3",
"v2.0.0-beta2",
"v2.0.0-beta1",
"v1.3.0",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.0",
"v1.0.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41383.json"
}
}
],
"modified": "2026-10-28T02:30:36.281380797Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41383.json",
"https://github.com/openclaw/openclaw/security/advisories/GHSA-m34q-h93w-vg5x",
"https://nvd.nist.gov/vuln/detail/CVE-2026-41383",
"https://www.vulncheck.com/advisories/openclaw-arbitrary-remote-directory-deletion-via-mis-scoped-mirror-mode-paths",
"https://github.com/openclaw/openclaw/commit/b21c9840c2e38f4bb338d031511b479d5f07ca25"
],
"provider_metadata": {
"cwe_ids": [
"CWE-22"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41383.json"
}
},
"related_cves": [
{
"value": "CVE-2026-41383",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503224,
"published_at": "2026-04-28T18:09:46.122+00:00"
}