CVE-2026-32033 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validatio…
Medium CVSS: 6.0

CVE-2026-32033

OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due to canonicalization mismatch. Attackers can exploit this by crafting @-prefixed paths like @/etc/passwd to read files outside the intended workspace boundary when tools.fs.workspaceOnly is enabled.
Vendor
Openclaw
Product
Openclaw
CWE
CWE-22
Yayın Tarihi
2026-03-19 22:16:38
Güncelleme
2026-03-25 15:16:46
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-22 Openclaw MEDIUM Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260 https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj https://www.vulncheck.com/advisories/openclaw-path-traversal-via-prefixed-absolute-paths-in-workspace-boundary-validation