Executive brief
OpenClaw is an AI assistant platform. A security vulnerability in its image processing tool allowed the system to access files outside of its designated safe workspace. An attacker could exploit this to read sensitive files from the underlying server that should have been protected by the system's security boundaries.
Technical details
A filesystem boundary bypass exists in OpenClaw's image tool due to improper enforcement of the 'tools.fs.workspaceOnly' policy. While other filesystem tools correctly restricted access, the image tool's path resolution logic could traverse sandbox bridge mounts to access directories outside the defined workspace. An authenticated attacker with network access can exploit this to read arbitrary files from mounted directories that are otherwise restricted. The fix, introduced in version 2026.3.2, ensures the 'fsPolicy' is correctly passed to the image tool and restricts local roots and sandbox-bridge resolution to the workspace.
Affected products
- OpenClaw openclaw < 2026.3.2
Timeline
- 2026-03-24: patched: Fix released in version 2026.3.2
- 2026-03-26: advisory: GitHub Advisory published
- 2026-04-10: other: NVD published the CVE record