{"id":"EUVD-2026-29198","enisaUuid":"40263de8-710b-3b69-9be6-5966df1c0988","description":"Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider\u0027s workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.","datePublished":"May 11, 2026, 6:12:51 PM","dateUpdated":"Oct 8, 2026, 3:22:44 PM","baseScore":6.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/crabbox/releases/tag/v0.9.0\nhttps://github.com/openclaw/crabbox/pull/65\nhttps://github.com/openclaw/crabbox/commit/6b07193fb5670aac315ea47215651c67b8127868\nhttps://www.vulncheck.com/advisories/crabbox-path-traversal-via-islo-provider-workspace-resolution\n","aliases":"CVE-2026-45224\n","assigner":"VulnCheck","epss":0.14,"enisaIdProduct":[{"id":"99c249e6-e4ee-3926-a3b5-7e0e1239f494","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c0.9.0"},{"id":"fa083d35-9a81-3b70-80e2-459401a24066","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"patch: 6b07193fb5670aac315ea47215651c67b8127868"}],"enisaIdVendor":[{"id":"bd57f54a-6a96-3f17-8804-ce6fb4aa05ea","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"72e9353c-2de9-36a7-98fa-d6201f754db3","vulnerability":{"id":"GHSA-3cjv-h753-qf7h","description":"Crabbox contains a path traversal vulnerability in the Islo provider\u0027s workspace path resolution","datePublished":"May 11, 2026, 9:31:34 PM","dateUpdated":"May 18, 2026, 4:48:18 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-45224\nhttps://github.com/openclaw/crabbox/pull/65\nhttps://github.com/openclaw/crabbox/commit/6b07193fb5670aac315ea47215651c67b8127868\nhttps://github.com/openclaw/crabbox\nhttps://github.com/openclaw/crabbox/releases/tag/v0.9.0\nhttps://www.vulncheck.com/advisories/crabbox-path-traversal-via-islo-provider-workspace-resolution\n","enisa_id":"EUVD-2026-29198\n","aliases":"GHSA-3cjv-h753-qf7h\nCVE-2026-45224\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"833fce8f-8b18-3f6b-85a6-8fade7f97465","vulnerability":{"id":"CVE-2026-45224","description":"Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider\u0027s workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.","datePublished":"May 11, 2026, 6:12:51 PM","dateUpdated":"Oct 8, 2026, 3:22:44 PM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/crabbox/releases/tag/v0.9.0\nhttps://github.com/openclaw/crabbox/pull/65\nhttps://github.com/openclaw/crabbox/commit/6b07193fb5670aac315ea47215651c67b8127868\nhttps://www.vulncheck.com/advisories/crabbox-path-traversal-via-islo-provider-workspace-resolution\n","enisa_id":"EUVD-2026-29198\n","assigner":"VulnCheck","epss":0.14,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"2c204b32-35b3-3b99-8a7b-0e25699f2b39","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c0.9.0"},{"id":"a5e7ac55-88ff-3e68-8c8a-09dee12664fb","product":{"name":"crabbox","vendor":{"name":"OpenClaw"}},"product_version":"patch: 6b07193fb5670aac315ea47215651c67b8127868"}],"vulnerabilityVendor":[{"id":"1f0fbf5c-71f6-3e78-98f9-b53e8e4ef519","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[]}