PT-2026-35793 · Openclaw · Openclaw

Rosayxy · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41911

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries. Attackers can exploit upload file and upload image endpoints to access files beyond the intended workspace-only filesystem policy.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41911

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5fc7-f62m-8983 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41911 · Security Note
• https://twitter.com/CVEnew/status/2049227510181736819 · Twitter Post
• https://vulncheck.com/advisories/openclaw-workspace-only-filesystem-policy-bypass-via-docx-upload-file-upload-image · Note