Fiche vulnérabilité
CVE-2026-32026 : faille élevée openclaw openclaw (CVSS 8.6)
Description
OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary directory outside the active sandbox root. Attackers can exploit this by providing malicious media references to read and exfiltrate arbitrary files from the host temporary directory through attachment delivery mechanisms.
En bref
- Sévérité
- Élevée (CVSS 8.6)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- Exploitation active
- Non signalée par la CISA
- Publication
- 19 mars 2026
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- openclaw openclaw
Références
- Fiche CVE-2026-32026 sur le NVD (NIST)
- github.com/openclaw/openclaw/commit/79a7b3d22ef92e36a4031…
- github.com/openclaw/openclaw/commit/d3da67c7a9b463edc1a9b…
- github.com/openclaw/openclaw/commit/def993dbd843ff28f2b3b…
- github.com/openclaw/openclaw/security/advisories/GHSA…
- vulncheck.com/advisories/openclaw…