What’s Vulnerable › Vulnerabilities

CVE-2026-32060: OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-11 · updated 2026-06-17
• Weakness: CWE-22

Description

OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.

Affected products

• OpenClaw: before 2026.2.14 — fixed in 2026.2.14

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.14. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/5544646a09c0121fca7d7093812dc2de8437c7f1
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r5fq-947m-xm57
• https://www.vulncheck.com/advisories/openclaw-path-traversal-in-apply-patch-via-crafted-paths

Get alerted when CVE-2026-32060 or the next vulnerability affects your stack