PT-2026-35793 · Openclaw · Openclaw

Rosayxy · Published 2026-04-09 · Updated 2026-04-30 · CVE-2026-41911

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description A filesystem policy bypass exists in the processing of docx uploads, enabling local file reads outside of workspace boundaries. This allows attackers to access files beyond the intended workspace-only filesystem policy via the 'upload file' and 'upload image' endpoints.

Recommendations Update to version 2026.4.8 or later. Restrict access to the 'upload file' and 'upload image' endpoints to minimize the risk of exploitation.

Fix

Incorrect Permission

Path traversal

Weakness Enumeration

CWE-732

CWE-22

Related Identifiers

CVE-2026-41911

GHSA-5FC7-F62M-8983

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5fc7-f62m-8983 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5fc7-f62m-8983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41911 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2049316817877750139 · Twitter Post
• https://twitter.com/CVEnew/status/2049227510181736819 · Twitter Post
• https://t.me/cveNotify/161627 · Telegram Post
• https://vulncheck.com/advisories/openclaw-workspace-only-filesystem-policy-bypass-via-docx-upload-file-upload-image · Note