CVE-2026-32846
OpenClaw is vulnerable to Path Traversal through path validation bypass
7.5
HIGH
CVSS 3.1
EPSS 0.69%
描述
OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.
如何修補 CVE-2026-32846
要修補 CVE-2026-32846,請將受影響套件升級到下列已修補版本。
- —升級至 2026.3.28 或更新版本
- —升級至 2026.03.28 或更新版本
CVE-2026-32846 正在被利用嗎?
低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 2026.3.28
- from 0, < 2026.03.28
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |