CVE-2026-41370: Openclaw Path Traversal Vulnerability

CVE-2026-41370 Overview

CVE-2026-41370 is a path traversal vulnerability affecting OpenClaw versions prior to 2026.3.31. The vulnerability exists in the ACP (Auto-reply Control Plane) dispatch functionality, specifically in how inbound channel attachment paths are processed. Remote attackers can exploit this flaw to bypass attachment-cache and root directory checks, enabling unauthorized access to arbitrary files outside intended directories.

This vulnerability represents a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) weakness, where insufficient validation of user-supplied path components allows directory traversal sequences to escape sandboxed file access.

Critical Impact
Authenticated remote attackers can read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, credentials, source code, and other confidential data.

Affected Products

OpenClaw versions before 2026.3.31
OpenClaw Node.js package (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*)

Discovery Timeline

2026-04-28 - CVE CVE-2026-41370 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41370

Vulnerability Analysis

The path traversal vulnerability in OpenClaw's ACP dispatch mechanism allows authenticated attackers to manipulate inbound channel attachment paths to access files outside the intended attachment cache directories. The vulnerability stems from insufficient path canonicalization and boundary enforcement when resolving attachment file paths.

When processing attachment requests through the ACP dispatch system, the application fails to properly validate that the resolved file path remains within the designated attachment root directories. This allows attackers to craft malicious path components containing directory traversal sequences (such as ../) that escape the sandboxed attachment storage location.

The impact is significant for confidentiality as attackers can potentially read any file readable by the application process, including configuration files containing database credentials, API keys, environment variables, and other sensitive system information.

Root Cause

The root cause lies in the src/auto-reply/reply/dispatch-acp.ts module where attachment paths from inbound channels are processed without adequate root directory enforcement. The application previously used direct filesystem access via node:fs/promises without verifying that resolved paths remained within approved attachment root directories.

The fix introduces proper path validation in src/media-understanding/attachments.cache.ts by importing constants as fsConstants from node:fs and implementing strict root boundary checks before file access operations.

Attack Vector

The attack is network-based and requires low privileges (authenticated user). An attacker must have valid credentials or session access to the OpenClaw application. The attacker can then craft malicious attachment path requests through the ACP dispatch interface, injecting path traversal sequences to navigate outside the intended attachment directories and read arbitrary files from the filesystem.

typescript

// Security patch in src/media-understanding/attachments.cache.ts
// Adds proper filesystem constants for path validation
+import { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { logVerbose, shouldLogVerbose } from "../globals.js";

Source: GitHub Commit Update

typescript

// Security patch in src/auto-reply/reply/dispatch-acp.ts
// Removes direct fs import in favor of centralized attachment handling
-import fs from "node:fs/promises";
 import { getAcpSessionManager } from "../../acp/control-plane/manager.js";
 import type { AcpTurnAttachment } from "../../acp/control-plane/manager.types.js";
 import { resolveAcpAgentPolicyError, resolveAcpDispatchPolicyError } from "../../acp/policy.js";

Source: GitHub Commit Update

Detection Methods for CVE-2026-41370

Indicators of Compromise

Unusual file access patterns in application logs showing requests for paths outside attachment directories
HTTP requests containing path traversal sequences (../, ..%2f, ..%5c) in attachment-related parameters
Access attempts to sensitive files like /etc/passwd, .env, configuration files, or credential stores
Error logs indicating failed file access attempts outside permitted directories

Detection Strategies

Implement web application firewall (WAF) rules to detect and block path traversal sequences in request parameters
Monitor application logs for attachment requests containing .. sequences or URL-encoded variants
Deploy file integrity monitoring on sensitive configuration files and directories
Use SentinelOne Singularity Platform to detect anomalous file access patterns from Node.js application processes
Implement runtime application self-protection (RASP) to detect and block path traversal attempts

Monitoring Recommendations

Enable verbose logging for the ACP dispatch module to capture all attachment path resolution attempts
Configure alerts for file access events outside designated attachment cache directories
Monitor for reconnaissance patterns where multiple path traversal attempts occur in sequence
Review access logs for authenticated users attempting to access non-attachment file paths

How to Mitigate CVE-2026-41370

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.31 or later immediately
Review application logs for signs of exploitation attempts
Audit file permissions to ensure the application process has minimal filesystem access
Implement network segmentation to limit exposure of affected OpenClaw instances

Patch Information

OpenClaw has released version 2026.3.31 which addresses this vulnerability by enforcing strict attachment root directory checks. The fix is available in commit 566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d.

For detailed patch information, refer to the GitHub Security Advisory GHSA-58q2-7r52-jq62 and the GitHub Commit Update.

Workarounds

Implement a reverse proxy or WAF rule to filter requests containing path traversal sequences before they reach OpenClaw
Restrict filesystem permissions for the OpenClaw process to only necessary directories
Deploy the application in a containerized environment with limited filesystem mounts
Use network-level access controls to restrict which users can access ACP dispatch endpoints

bash

# Example: Configure reverse proxy to block path traversal attempts
# Add to nginx configuration
location /api/acp/ {
    # Block requests containing path traversal sequences
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    proxy_pass http://openclaw-backend;
}