CVE-2026-32846
OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read
- State
- Published
- Severity
- 8.7 High
- Published
- Mar 26, 2026
- Updated
- Oct 8, 2026
- Reserved
- Mar 16, 2026
Description
OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94rvendor-advisory
- https://github.com/openclaw/openclaw/pull/54642issue-tracking
- https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37patch
- https://www.vulncheck.com/advisories/openclaw-media-parsing-path-traversal-to-arbitrary-file-readthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.