PT-2026-29545 · Openclaw · Openclaw

Fushuling + 1 · Publicado 2026-04-01 · Atualizado 2026-04-16 · CVE-2026-34510

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended access restrictions.

Correção

Enumeração de Fraquezas

CWE-41

Identificadores relacionados

CVE-2026-34510

Produtos afetados

Openclaw

Referências · 8

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Correção
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901 · Correção
• https://github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5 · Correção
• https://reddit.com/r/better_claw/comments/1sn5blc/the_openclaw_ecosystem_now_has_138_documented · Publicação no Reddit
• https://vulncheck.com/advisories/openclaw-remote-file-url-acceptance-in-windows-media-loaders · Nota
• https://reddit.com/r/openclaw/comments/1sn592t/the_openclaw_ecosystem_now_has_138_documented · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34510 · Nota de Segurança