Which versions of OpenClaw are affected by EUVD-2026-27275?

The OpenClaw npm package (versions 2026.4.7-2026.4.9) contains a path traversal vulnerability that allows authenticated Discord bot operators to read arbitrary files from the host system by…. A patch is available.

How to fix or mitigate EUVD-2026-27275?

Within 24 hours: Identify all internal services and applications using OpenClaw npm package and document their current versions. Within 7 days: Upgrade OpenClaw to version 2026.4.10 or later across all affected environments; verify the upgrade and test Discord event cover image functionality. Within 30 days: Review bot access logs for suspicious file path requests and conduct code review of any custom event cover image handling to ensure no similar path traversal vectors exist elsewhere.

OpenClaw EUVD-2026-27275

Q: What is the CVSS score of EUVD-2026-27275?

EUVD-2026-27275 has a CVSS 4.0 base score of 4.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-43532 MEDIUM

Incomplete List of Disallowed Inputs (CWE-184)

2026-05-05 VulnCheck

Authentication Bypass Openclaw

4.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 05, 2026 - 12:37 NVD

HIGH MEDIUM

CVSS changed

May 05, 2026 - 12:37 NVD

7.7 (HIGH) 4.9 (MEDIUM)

Source Code Evidence Fetched

May 05, 2026 - 12:19 vuln.today

Analysis Generated

May 05, 2026 - 12:19 vuln.today

DescriptionCVE.org

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media.

AnalysisAI

Path traversal in OpenClaw npm package allows authenticated attackers to expose confidential host-local files via Discord event cover image parameters. Versions 2026.4.7 through 2026.4.9 fail to normalize Discord event cover image paths through sandbox media processing, enabling attackers with low-privilege Discord bot credentials to bypass media sandboxing and inject host-local file references (e.g., file:///workspace/assets/event-cover.png) into channel actions expecting normalized media. This results in high confidentiality impact with scope change, as local filesystem paths outside the intended sandbox can be accessed. Vendor-released patch available (2026.4.10+). No active exploitation confirmed (not in CISA KEV), but public exploit code exists via GitHub commit and advisory.

Technical ContextAI

OpenClaw is an npm package providing Discord bot integration capabilities. The vulnerability stems from CWE-184 (Incomplete List of Disallowed Inputs), where the sandbox media normalization function checked only specific parameter keys ('media', 'path', 'filePath', 'mediaUrl', 'fileUrl') but omitted the 'image' parameter used by Discord's eventCreate API. When processing Discord event cover images, the code failed to rewrite file:// URIs pointing to host-local paths into sandbox-rooted paths. This allowed an attacker to craft Discord event creation requests with 'image' parameters containing absolute filesystem paths that would bypass the normalization routine and reach downstream channel action handlers expecting only sandboxed media references. The fix adds 'image' to the SANDBOX_MEDIA_PARAM_KEYS allowlist and includes test coverage for the event-create media path, ensuring all user-controllable media parameters undergo path rewriting before reaching sensitive file operations.

RemediationAI

Upgrade to OpenClaw version 2026.4.10 or newer immediately. The vendor-released patch is confirmed in stable tag v2026.4.10, with the latest npm release 2026.4.14 already including the fix. Update via npm with 'npm install openclaw@latest' or specify 'openclaw@^2026.4.10' in package.json dependencies. The fix commit 979c6f09d6fad96596feb91c905934be7e0b4f15 (PR #64377) adds 'image' to the SANDBOX_MEDIA_PARAM_KEYS array, ensuring Discord event cover images undergo the same path normalization as other media parameters. If immediate upgrade is not feasible, implement compensating controls: (1) Restrict Discord bot permissions to prevent event creation capabilities - this eliminates the attack vector but breaks event management functionality; (2) Deploy OpenClaw bot processes in isolated containers with read-only filesystem mounts for workspace directories, limiting exposure of sensitive files - adds operational overhead and may impact legitimate media operations; (3) Implement application-layer input validation to reject file:// URIs in all Discord API parameters before they reach OpenClaw - requires code changes and thorough testing of all media workflows. None of these workarounds are preferable to the vendor patch. Refer to GitHub advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-c9h3-5p7r-mrjh and patch commit https://github.com/openclaw/openclaw/commit/979c6f09d6fad96596feb91c905934be7e0b4f15 for full technical details.