PT-2026-28443 · Openclaw · Openclaw

Vulncheck + 1 · Publicado 2026-03-26 · Atualizado 2026-05-20 · CVE-2026-32846

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions through 2026.3.23

Description The software contains a path traversal issue in media parsing. This allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. The incomplete validation and the allowBareFilename bypass enable attackers to reference files outside the intended application sandbox, potentially disclosing sensitive information such as system files, environment files, and SSH keys.

Recommendations Update to a version after commit 4797bbc to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-32846

GHSA-HGGM-X7R9-MM7V

Produtos afetados

Openclaw

Referências · 10

• 🔥 https://github.com/openclaw/openclaw/pull/54642 · Exploit
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94r · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37 · Correção
• https://vulncheck.com/advisories/openclaw-media-parsing-path-traversal-to-arbitrary-file-read · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32846 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037513436003803203 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hggm-x7r9-mm7v · Aviso do Fabricante
• https://t.me/cveNotify/164296 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2037515525144694905 · Publicação no Twitter