CVE-2026-41911: Openclaw Path Traversal Vulnerability

CVE-2026-41911 Overview

CVE-2026-41911 is a filesystem policy bypass vulnerability in OpenClaw versions prior to 2026.4.8. The flaw resides in the docx upload processing logic exposed through the upload_file and upload_image endpoints. An authenticated attacker can submit crafted docx content that escapes the workspace-only filesystem policy. This allows local file reads on paths outside the intended workspace boundary. The vulnerability is tracked under [CWE-22] (Path Traversal) and impacts the Node.js distribution of OpenClaw.

Critical Impact
Authenticated network attackers can read sensitive files outside the OpenClaw workspace, including configuration data and credentials accessible to the service account.

Affected Products

OpenClaw (Node.js) versions prior to 2026.4.8
Deployments exposing the upload_file endpoint
Deployments exposing the upload_image endpoint

Discovery Timeline

2026-04-28 - CVE-2026-41911 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-41911

Vulnerability Analysis

OpenClaw enforces a workspace-only filesystem policy intended to confine read and write operations to a designated project directory. The docx upload handler processes embedded resources and references during file ingestion. The handler fails to apply the workspace policy consistently across both the upload_file and upload_image code paths.

An attacker who can authenticate with low privileges crafts a docx payload that references paths outside the workspace root. When the server processes the upload, the policy check is bypassed and the underlying filesystem read resolves the attacker-controlled path. The result is unauthorized disclosure of file contents from anywhere the OpenClaw process can read.

The issue affects confidentiality only. Integrity and availability are not impacted by this vector.

Root Cause

The root cause is inconsistent enforcement of the workspace boundary check inside the docx processing routine. The endpoints accept upload payloads before validating that referenced filesystem paths resolve within the workspace root. Path normalization and policy evaluation occur after the filesystem access has been initiated.

Attack Vector

The attack vector is network-based and requires low privileges. The attacker uploads a malicious docx through either upload_file or upload_image. Embedded path references in the docx structure are resolved by the server against the local filesystem outside the workspace scope. No user interaction is required beyond the attacker's own session.

The fix is delivered in commit d7c3210 and documented in the OpenClaw GHSA-5fc7-f62m-8983 Security Advisory. Technical details are also published in the VulnCheck Advisory. The patch tightens path resolution and enforces the workspace policy before any filesystem read occurs during docx processing.

Detection Methods for CVE-2026-41911

Indicators of Compromise

Requests to /upload_file or /upload_image containing docx files with embedded references to absolute paths or parent directory traversal sequences (../).
OpenClaw application logs showing filesystem reads outside the configured workspace directory.
docx archives whose internal XML references resolve to system paths such as /etc/, /root/, or user home directories.
Unusual outbound transfer of small text or configuration files immediately following a docx upload event.

Detection Strategies

Inspect upload handler logs and correlate uploaded docx filenames with subsequent file read syscalls from the OpenClaw process.
Compare file access audit events against the configured workspace path to surface reads that fall outside the allowed boundary.
Parse docx upload payloads at an inline proxy and flag archives containing path traversal patterns or absolute filesystem references.

Monitoring Recommendations

Enable verbose request logging for the upload_file and upload_image endpoints, including authenticated user identity.
Forward OpenClaw process file access events and web logs into a centralized SIEM for correlation against the workspace path baseline.
Alert on any read of sensitive files (such as /etc/passwd, environment files, or private keys) by the OpenClaw service account.

How to Mitigate CVE-2026-41911

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.8 or later on all affected hosts.
Audit application logs for prior calls to upload_file and upload_image and review any docx uploads from low-privileged accounts.
Rotate any secrets or credentials that were readable from the OpenClaw host filesystem if exploitation is suspected.
Restrict network access to OpenClaw upload endpoints to trusted networks until patching is complete.

Patch Information

The fix is available in OpenClaw 2026.4.8. Refer to the upstream commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 and the GitHub Security Advisory GHSA-5fc7-f62m-8983 for the full set of changes. Operators should validate that deployed builds resolve to the patched release before re-exposing the upload endpoints.

Workarounds

Disable the upload_file and upload_image endpoints at the reverse proxy until the patched release is deployed.
Run the OpenClaw process under a dedicated low-privilege user with filesystem access restricted to the workspace directory via OS-level controls.
Enforce mandatory access controls (AppArmor, SELinux) that confine OpenClaw reads to the workspace path.
Require additional authentication or VPN access in front of OpenClaw to limit exposure to authenticated upload abuse.

bash

# Confine the OpenClaw service to its workspace directory using systemd
# /etc/systemd/system/openclaw.service.d/override.conf
[Service]
ReadWritePaths=/var/lib/openclaw/workspace
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true