CVE-2026-33581

Katalog CVE

CVSS 8.6 · High EPSS 0,64%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada openclaw. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-v8wv-jg3q-qwpq advisory vendor
• https://github.com/openclaw/openclaw/commit/1d7cb6fc03552bbba00e7cffb3aa9741f5556416 patch
• https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-mediaurl-and-fileurl-parameters advisory pihak ketiga