CVE-2026-32846

N/A

Description

OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.

Details CVE

Score CVSS v3.1N/A

Publie3/26/2026

Derniere modification3/27/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-22

References

https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/pull/54642(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94r(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-media-parsing-path-traversal-to-arbitrary-file-read(disclosure@vulncheck.com)

https://github.com/openclaw/openclaw/pull/54642(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.