CVE-2026-32846: OpenClaw Path Traversal Vulnerability

CVE-2026-32846 Overview

CVE-2026-32846 is a path traversal vulnerability in OpenClaw through version 2026.3.23 that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. The vulnerability exists in the media parsing functionality, where incomplete validation and the allowBareFilename bypass enable attackers to reference files outside the intended application sandbox.

Critical Impact
Successful exploitation allows unauthenticated remote attackers to disclose sensitive information including system files, environment files, and SSH keys through path traversal sequences.

Affected Products

OpenClaw versions through 2026.3.23
OpenClaw installations prior to commit 4797bbc

Discovery Timeline

2026-03-26 - CVE CVE-2026-32846 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-32846

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in OpenClaw's media parsing layer. The vulnerable functions isLikelyLocalPath() and isValidMedia() fail to properly validate file paths before processing, allowing attackers to break out of the intended application sandbox. The vulnerability is exploitable over the network without authentication and can be triggered without user interaction.

The root issue stems from a design assumption that security validation would be handled by downstream functions (loadWebMedia / resolveSandboxedMediaSource), but the parsing layer accepted traversal patterns that could be exploited before reaching those enforcement points.

Root Cause

The vulnerability originates from incomplete path validation in the media parsing layer. The original isLikelyLocalPath() function was designed only to recognize local file path patterns, with security validation intentionally deferred to the load layer. However, this deferral created a gap where path traversal sequences (../, .., ~) were not rejected early in the parsing process, allowing attackers to reference files outside the sandbox before proper validation could occur.

Attack Vector

Attackers can exploit this vulnerability by crafting malicious media references containing path traversal sequences. The network-accessible attack vector requires no authentication or user interaction. By leveraging patterns such as ../../../etc/passwd or ~/.ssh/id_rsa, attackers can traverse directory structures and access sensitive files including:

System configuration files (/etc/passwd, /etc/shadow)
Environment files containing secrets
SSH private keys
Application configuration with credentials

The following patch demonstrates the security fix implemented in commit 4797bbc:

typescript

 const SCHEME_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
 const HAS_FILE_EXT = /\.\w{1,10}$/;
 
-// Recognize local file path patterns. Security validation is deferred to the
-// load layer (loadWebMedia / resolveSandboxedMediaSource) which has the context
-// needed to enforce sandbox roots and allowed directories.
-function isLikelyLocalPath(candidate: string): boolean {
+// Matches ".." as a standalone path segment (start, middle, or end).
+const TRAVERSAL_SEGMENT_RE = /(?:^|[/\\])\.\.(?:[/\\]|$)/;
+
+function hasTraversalOrHomeDirPrefix(candidate: string): boolean {
+  return (
+    candidate.startsWith("../") ||
+    candidate === ".." ||
+    candidate.startsWith("~") ||
+    TRAVERSAL_SEGMENT_RE.test(candidate)
+  );
+}
+
+// Broad structural check: does this look like a local file path? Used only for
+// stripping MEDIA: lines from output text — never for media approval.
+function looksLikeLocalFilePath(candidate: string): boolean {
   return (
     candidate.startsWith("/") ||
     candidate.startsWith("./") ||

Source: GitHub Commit Details

Detection Methods for CVE-2026-32846

Indicators of Compromise

HTTP requests containing path traversal sequences (../, ..%2F, %2e%2e/) in media-related parameters
Access attempts to sensitive system files (/etc/passwd, ~/.ssh/) through the media parsing endpoint
Unusual file read operations originating from the OpenClaw application process
Log entries showing media requests with traversal patterns or home directory prefixes (~)

Detection Strategies

Deploy web application firewall (WAF) rules to detect and block path traversal patterns in request parameters
Monitor application logs for media parsing requests containing .., ~, or encoded traversal sequences
Implement file integrity monitoring (FIM) on sensitive system directories to detect unauthorized access
Configure intrusion detection systems (IDS) to alert on directory traversal attack signatures

Monitoring Recommendations

Enable verbose logging for the OpenClaw media parsing module to capture all file access attempts
Set up alerts for any file access operations outside the designated media sandbox directory
Monitor network traffic for anomalous file disclosure patterns in HTTP responses
Regularly audit access logs for patterns consistent with path traversal exploitation attempts

How to Mitigate CVE-2026-32846

Immediate Actions Required

Update OpenClaw to a version containing commit 4797bbc or later
Audit logs for evidence of exploitation attempts using path traversal patterns
Review any exposed sensitive files and rotate credentials if compromise is suspected
Implement network-level controls to restrict access to OpenClaw instances until patching is complete

Patch Information

The vulnerability is fixed in commit 4797bbc5b96e2cca5532e43b58915c051746fe37. The patch introduces a new hasTraversalOrHomeDirPrefix() function that explicitly rejects path traversal patterns (../, ..) and home directory prefixes (~) at the media parsing layer, preventing sandbox escape attempts before they reach downstream processing.

For detailed information about the fix, refer to the GitHub Pull Request and GitHub Security Advisory.

Workarounds

Implement a reverse proxy or WAF rule to filter requests containing ../, ..%2F, or ~ patterns in media-related parameters
Restrict OpenClaw to trusted network segments until the patch can be applied
Apply operating system-level file permissions to limit the application's read access to only required directories
Consider containerizing the OpenClaw application with restricted filesystem access as defense-in-depth

bash

# Example WAF rule to block path traversal (ModSecurity syntax)
SecRule REQUEST_URI|ARGS|ARGS_NAMES "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.%2e/|%2e\./)" \
    "id:100001,phase:2,deny,status:403,msg:'Path Traversal Attempt Blocked'"