CVE-2026-32846 Details
Description
OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.
A path traversal vulnerability has been identified in OpenClaw versions through 2026.3.23, excluding the patched version in commit 4797bbc. This vulnerability arises in the media parsing component, where inadequate path validation in the functions 'isLikelyLocalPath()' and 'isValidMedia()' allows attackers to bypass restrictions and access arbitrary files. Exploitation of this vulnerability can lead to the disclosure of sensitive information, including system files, environment files, and SSH keys, by referencing files outside the intended application sandbox.
Users can update to OpenClaw version 2026.3.23 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openclaw/openclaw/pull/54642 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37 | [email protected] | Patch |
| https://github.com/openclaw/openclaw/pull/54642 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94r | [email protected] | Broken Link |
| https://www.vulncheck.com/advisories/openclaw-media-parsing-path-traversal-to-arbitrary-file-read | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | <= 2026.3.23 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | CVE Modified | [email protected] |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |