OpenClaw Media Parsing Path Traversal to Arbitrary File Read

OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.

N/A

对路径名的限制不恰当(路径遍历)

OpenClaw 路径遍历漏洞

OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.3.23及之前版本存在路径遍历漏洞，该漏洞源于媒体解析中存在路径遍历，可能导致攻击者读取任意文件并泄露敏感信息。

N/A

N/A