PT-2026-29545 · Openclaw · Openclaw

Fushuling + 1 · Published 2026-04-01 · Updated 2026-04-16 · CVE-2026-34510

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended access restrictions.

Fix

Weakness Enumeration

CWE-41

Related Identifiers

CVE-2026-34510

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901 · Patch
• https://github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34510 · Security Note
• https://reddit.com/r/better_claw/comments/1sn5blc/the_openclaw_ecosystem_now_has_138_documented · Reddit Post
• https://vulncheck.com/advisories/openclaw-remote-file-url-acceptance-in-windows-media-loaders · Note
• https://reddit.com/r/openclaw/comments/1sn592t/the_openclaw_ecosystem_now_has_138_documented · Reddit Post