PT-2026-26016 · Openclaw · Openclaw

Baozongwixd · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-27522

NVD

CVSS v3.1

6.5

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-27522

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/270ab03e379f9653e15f7033c9830399b66b7e51 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27522 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fqcm-97m6-w7rm · Note
• https://vulncheck.com/advisories/openclaw-arbitrary-file-read-via-sendattachment-and-setgroupicon-message-actions · Note