Junglewise Threat Intelligence

CVE-2026-32846: OpenClaw path traversal in media parsing

CVE-2026-32846 · Severity: high · CVSS 7.5 · Published 2026-03-26

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw, a media parsing library, contains a security flaw that allows unauthorized access to files on the host system. By sending specially crafted requests, an attacker can bypass security checks to read sensitive information such as system configuration files, environment variables, and private SSH keys. This could lead to a full compromise of the server or the exposure of customer data.

Technical details

A path traversal vulnerability exists in OpenClaw's media parsing logic within `src/media/parse.ts`. The root cause is incomplete validation in the `isLikelyLocalPath()` and `isValidMedia()` functions, which fail to properly neutralize directory traversal sequences (e.g., `../`) and home directory shortcuts (e.g., `~`). Additionally, an `allowBareFilename` bypass allows certain patterns to evade file-extension regex checks. An unauthenticated remote attacker can exploit these flaws to reference files outside the intended application sandbox, resulting in arbitrary file disclosure. The issue is fixed in version 2026.3.28 (commit 4797bbc).

Affected products

  • openclaw openclaw <= 2026.3.23

Timeline

  • 2026-03-25: patched: Fix merged in commit 4797bbc
  • 2026-03-26: disclosed: CVE-2026-32846 published
  • 2026-03-26: advisory: GHSA-hggm-x7r9-mm7v published

References

Related threats