CVE-2026-33581 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and…
High CVSS: 7.1

CVE-2026-33581

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.
Vendor
Openclaw
Product
Openclaw
CWE
CWE-22
Yayın Tarihi
2026-03-31 15:16:15
Güncelleme
2026-04-01 19:01:07
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-22 Openclaw HIGH Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/1d7cb6fc03552bbba00e7cffb3aa9741f5556416 https://github.com/openclaw/openclaw/security/advisories/GHSA-v8wv-jg3q-qwpq https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-mediaurl-and-fileurl-parameters