EUVD-2026-16248
GHSA-hggm-x7r9-mm7v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.
AnalysisAI
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files including system configurations, environment files, and SSH private keys by bypassing media parsing validation functions. The vulnerability stems from incomplete path validation in isLikelyLocalPath() and isValidMedia() functions, with an allowBareFilename bypass permitting sandbox escape. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit OpenClaw through version 2026.3.23 via media parsing functions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.7 HIGH severity reflects genuine risk given the attack vector characteristics: network-accessible (AV:N), no authentication required (PR:N), low attack complexity (AC:L), and no user interaction needed (UI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker crafts a malicious media file reference containing path traversal sequences (e.g., ../../etc/passwd or ../../root/.ssh/id_rsa) and submits it to the OpenClaw media parsing interface via HTTP request. The incomplete validation in isLikelyLocalPath() and isValidMedia() functions, combined with the allowBareFilename bypass, permits the application to process the traversal path and return the contents of files outside the intended sandbox, disclosing SSH private keys, application configuration files containing credentials, or environment files with API tokens that enable further compromise of the system or connected services. |
| Remediation | Upgrade OpenClaw to commit 4797bbc5b96e2cca5532e43b58915c051746fe37 or later, which contains the fix for the path traversal vulnerability (see patch at https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37 and pull request https://github.com/openclaw/openclaw/pull/54642). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running OpenClaw versions ≤2026.3.23 and assess exposure in air-gapped or internet-facing environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote code execution in OpenClaw before 2026.5.12 allows authenticated operators to bypass the PowerShell execution all
Command injection in OpenClaw before 2026.5.18 allows authenticated attackers to modify shell wrapper argv between appro
Arbitrary code execution in OpenClaw before 2026.5.27 lets attackers hijack the Homebrew executable resolved during skil
Authentication bypass in OpenClaw before 2026.5.22 allows authenticated network attackers to spoof locality information
Privilege escalation in OpenClaw before 2026.5.18 allows WebSocket-connected Control UI clients to claim operator.admin
Share
External POC / Exploit Code
Leaving vuln.today