What’s Vulnerable › Vulnerabilities

CVE-2026-32846: OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-26 · updated 2026-10-08
• Weakness: CWE-22

Description

OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.

Affected products

• OpenClaw: through 2026.3.23

References

• https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37
• https://github.com/openclaw/openclaw/pull/54642
• https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94r
• https://www.vulncheck.com/advisories/openclaw-media-parsing-path-traversal-to-arbitrary-file-read
• https://github.com/openclaw/openclaw/pull/54642

Get alerted when CVE-2026-32846 or the next vulnerability affects your stack