Executive brief
OpenClaw is an AI agent framework that includes functionality to dispatch requests through its ACP (Agent Control Protocol). A path traversal vulnerability in how attachment paths are validated during inbound channel dispatch allows an authenticated attacker to read arbitrary files from the system by crafting malicious attachment path inputs. This could expose sensitive configuration files, private keys, or other confidential data stored on the server.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in the inbound channel attachment path handling within OpenClaw's ACP dispatch logic. The vulnerable code does not properly enforce that attachment paths remain restricted to the designated attachment-cache or root directories, allowing an attacker to traverse the filesystem using relative path sequences (e.g., "../") to access files outside the restricted directory. The fix, released in version 2026.3.31, enforces stricter root path validation and hardens the attachment cache read logic. The vulnerability requires an authenticated user (login required) and network access to the ACP dispatch endpoint; no user interaction is needed beyond crafting a malicious request. An attacker can read any file accessible to the OpenClaw process.
Affected products
- OpenClaw openclaw <=2026.3.28
Timeline
- 2026-04-03: disclosed: Vulnerability published as GHSA-58q2-7r52-jq62
- 2026-03-31: patched: Fix released in version 2026.3.31
- 2026-03-30: other: Fix commit 566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d merged