CVE-2026-32846 OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read
Attackers can read arbitrary files, including system files and SSH keys, by exploiting path traversal flaws in OpenClaw's media parsing logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32846?
CVE-2026-32846 is a high-severity path traversal vulnerability in Openclaw Openclaw, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.
Weakness: CWE-22
Which versions are affected by CVE-2026-32846?
4 open source packages ship an affected version, including openclaw. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | All versions | 2026.03.28 |
openclaw npm | All versions | 2026.03.28 |
openclaw npm | All versions | 2026.3.28 |
openclaw npm | All versions | 2026.3.28 |
Products include Openclaw Openclaw.
How do I fix CVE-2026-32846?
Upgrade openclaw to a fixed version for your release line: 2026.03.28 or 2026.3.28.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-32846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32846 exists.
Other vulnerabilities in Openclaw Openclaw
- CVE-2026-28363 Security feature bypass in OpenClaw
- CVE-2026-30741 Code injection in n/a
- CVE-2026-33579 OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
- CVE-2026-32922 OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate
- CVE-2026-32978 OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners
Sources
Also known as GHSA-f6pf-4gjx-c94r, GHSA-hggm-x7r9-mm7v, MINI-9r23-69ff-vj3v, MINI-p49q-j29p-x42j.