PT-2026-28443 · Openclaw · Openclaw

Vulncheck + 1 · Published 2026-03-26 · Updated 2026-05-20 · CVE-2026-32846

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions through 2026.3.23

Description The software contains a path traversal issue in media parsing. This allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. The incomplete validation and the allowBareFilename bypass enable attackers to reference files outside the intended application sandbox, potentially disclosing sensitive information such as system files, environment files, and SSH keys.

Recommendations Update to a version after commit 4797bbc to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32846

GHSA-HGGM-X7R9-MM7V

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/openclaw/openclaw/pull/54642 · Exploit
• https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32846 · Security Note
• https://osv.dev/vulnerability/GHSA-hggm-x7r9-mm7v · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-media-parsing-path-traversal-to-arbitrary-file-read · Note
• https://twitter.com/CVEnew/status/2037513436003803203 · Twitter Post
• https://t.me/cveNotify/164296 · Telegram Post
• https://twitter.com/infoflowcloud/status/2037515525144694905 · Twitter Post