CVE-2026-100536: OpenClaw Path Traversal Vulnerability

CVE-2026-100536 Overview

CVE-2026-100536 is a path traversal vulnerability [CWE-22] affecting OpenClaw versions before 2026.8.1. The flaw stems from incomplete validation of source fields in structured message attachments. OpenClaw validates the first source field but ignores additional sources supplied in the same attachment object. Attackers can smuggle arbitrary host paths behind an allowed attachment source, bypassing sandbox path restrictions. When OpenClaw processes the attachment for Telegram delivery, it reads the attacker-specified host file and transmits it to the destination chat. Exploitation requires low privileges and no user interaction over the network.

Critical Impact
Authenticated attackers can exfiltrate arbitrary files from the host running OpenClaw by crafting multi-source attachments that bypass sandbox path validation and reach Telegram delivery.

Affected Products

OpenClaw versions prior to 2026.8.1
Deployments using structured message attachments
Instances configured for Telegram message delivery

Discovery Timeline

2026-09-26 - CVE-2026-100536 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100536

Vulnerability Analysis

OpenClaw accepts structured attachment objects that include one or more source fields identifying files to attach to outbound Telegram messages. The sandbox path validator inspects a single source field to confirm that the referenced file lies within an allowed directory. When multiple source fields are supplied, only the first is validated. Subsequent source fields are consumed by the Telegram delivery routine without re-validation.

An attacker who can submit attachment objects supplies one benign source that passes validation and one or more additional sources pointing to arbitrary host paths. The delivery routine opens each listed source and transmits the contents. Files that should be rejected by the sandbox, including configuration files, credential stores, and application secrets, are read and exfiltrated through the Telegram channel.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Validation logic treats the attachment as having a single source and does not iterate across all source entries. The attachment schema permits multiple sources, creating a parser differential between the validator and the delivery component.

Attack Vector

Exploitation occurs over the network. The attacker needs low-privileged access sufficient to submit a structured message with attachments. The attachment payload includes an allowed source alongside a crafted source such as /etc/passwd or an application secrets file. OpenClaw validates the allowed source, then delivers all listed sources to the configured Telegram chat.

See the GitHub Security Advisory GHSA-fphf-69cp-h5xw and the VulnCheck OpenClaw Path Traversal Advisory for additional technical details.

Detection Methods for CVE-2026-100536

Indicators of Compromise

Structured attachment payloads containing more than one source field in a single attachment object
Telegram outbound messages carrying files whose paths fall outside the configured OpenClaw sandbox directory
OpenClaw logs showing attachment delivery of host paths such as /etc/, /var/, or application configuration directories

Detection Strategies

Inspect OpenClaw request logs for attachment objects that declare multiple source entries
Correlate attachment source paths against the configured sandbox root and alert on any path outside allowed boundaries
Monitor Telegram bot API traffic from OpenClaw hosts for file uploads referencing unexpected filenames or extensions

Monitoring Recommendations

Enable verbose logging on OpenClaw attachment processing and forward logs to a centralized analytics platform
Track file read operations by the OpenClaw process against sensitive host paths using endpoint telemetry
Alert on any OpenClaw-initiated reads targeting credential files, SSH keys, or environment configuration files

How to Mitigate CVE-2026-100536

Immediate Actions Required

Upgrade OpenClaw to version 2026.8.1 or later on all affected hosts
Audit recent Telegram delivery logs for attachments sourced from paths outside the sandbox
Rotate any credentials or secrets stored on hosts that run vulnerable OpenClaw instances
Restrict network access to OpenClaw submission endpoints to trusted users only

Patch Information

The fix is included in OpenClaw release 2026.8.1. The patched version validates every source field present in structured attachments against the sandbox policy. Refer to the GitHub Security Advisory GHSA-fphf-69cp-h5xw for the official remediation notice.

Workarounds

Reject or strip attachment objects that contain more than one source field at an upstream proxy or API gateway
Run OpenClaw under a dedicated low-privilege account with filesystem access limited to the attachment sandbox directory
Disable the Telegram delivery integration until the patched version can be deployed

bash

# Configuration example
# Verify the installed OpenClaw version meets the fixed release
openclaw --version
# Expected output: 2026.8.1 or later