VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-32026

CVE-2026-32026

Description

OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary directory outside the active sandbox root. Attackers can exploit this by providing malicious media references to read and exfiltrate arbitrary files from the host temporary directory through attachment delivery mechanisms.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.2.242026.2.24

Affected products

3
  • OpenClaw/Openclaw2 versions
    cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.24
    • (no CPE)range: 0
  • ghsa-coords
    pkg:npm/openclaw
    Range: < 2026.2.24

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.