CVE-2026-33574

OpenClaw is affected before 2026.3.8 by a path traversal in the skills download installer. The root tools directory is validated lexically but the mutable path is reused during archive download and copy, allowing a local attacker to rebind the tools-root between validation and final write and red...