Medium severity6.5NVD Advisory· Published Jun 12, 2026· Updated Jun 16, 2026

CVE-2026-53825

Description

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file paths to import file content into wiki memory, bypassing access restrictions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.7
- (no CPE)range: < 2026.4.7

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/security/advisories/GHSA-p2fh-f5fc-44hrnvdMitigationVendor Advisory
www.vulncheck.com/advisories/openclaw-arbitrary-local-file-read-via-memory-wiki-ingest-with-operator-write-scopenvdThird Party Advisory

News mentions

OpenClaw: 25 CVEs Disclosed in Largest Security Batch, Including Code Execution and Critical Auth Bypass
Vypr Intelligence · Jun 12, 2026

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000