EUVD-2026-21482
GHSA-hr5v-j9h9-xjhg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as sandboxed agent
-
DeliveryCraft request with unnormalized fileUrl parameter
-
ExploitBypass path normalization in normalizeSandboxMediaParams
-
ExecutionTraverse to other agents' workspace directories
-
ImpactRead arbitrary files including API keys
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to OpenClaw before version 2026.3.24 with sandbox agent privileges. Attacker must craft requests with unnormalized mediaUrl or fileUrl parameters to traverse sandbox boundaries and access other agents' workspace files containing API keys and configuration data. |
| Impact | CVSS 7.7 reflects high confidentiality impact with network accessibility and low attack complexity. Authenticated users can traverse sandbox boundaries to exfiltrate API keys and configs from peer agent workspaces. EPSS data unavailable; exploitation likelihood moderate given parameter validation flaw is straightforward once authenticated. Prioritize patching in multi-tenant or untrusted-user deployments. |
| Exploit ScenarioDerived | Authenticated user submits mediaUrl or fileUrl parameter with path traversal sequences (e.g., |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Path traversal in OpenClaw before 2026.3.24 allows authenticated sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameters. Incomplete validation in normalizeSandboxMediaParams and missing mediaLocalRoots context enables attackers to bypass sandbox boundaries and access sensitive data including API keys and configuration files outside designated roots. This cross-agent data leakage vulnerability requires low-privilege authentication but no user interaction. No public exploit identified at time of analysis.
RemediationAI
Upgrade to OpenClaw version 2026.3.24 or later, which addresses the path traversal vulnerability through enhanced parameter validation and proper mediaLocalRoots enforcement. If immediate upgrade is not feasible, implement strict input validation on all mediaUrl and fileUrl parameters to reject unnormalized paths containing traversal sequences (../, .\). Review sandbox configuration to ensure mediaLocalRoots restrictions are properly defined and enforced. Audit agent workspace permissions and rotate potentially exposed API keys or configuration credentials that may have been accessed. Consult vendor security advisory for complete details: https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg and https://www.vulncheck.com/advisories/openclaw-sandbox-media-root-bypass-via-unnormalized-mediaurl-and-fileurl-parameters
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause stems from CWE-22 path traversal in parameter normalization logic. The normalizeSandboxMediaParams function fails to properly validate mediaUrl/fileUrl keys against mediaLocalRoots context, allowing directory traversal sequences to escape sandbox boundaries. Network-accessible with low attack complexity, requiring only authenticated sandboxed agent privileges to traverse filesystem paths across isolated workspace contexts.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots.
Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.24.
Executive ViewAI
OpenClaw versions before 2026.3.24 contain a path traversal vulnerability that allows authenticated users with low-privilege access to read arbitrary files across agent workspaces, including sensitive credentials and configuration data. This cross-sandbox boundary breach exposes multi-tenant environments to lateral data leakage and credential compromise without requiring special privileges or user interaction.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict authenticated access to OpenClaw to trusted administrators only; (2) Separate high-sensitivity agents into isolated OpenClaw instances rather than shared multi-agent deployments; (3) Implement file system-level access controls to limit mediaUrl/fileUrl parameter scope; (4) Monitor and audit file access logs for abnormal cross-agent queries; (5) Rotate all API keys and credentials currently stored in agent workspaces and move them to external secure vaults external to OpenClaw storage.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in OpenClaw Multiple Authorization and Privilege Escalation
View all 29Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB