CVE-2026-26329: OpenClaw Path Traversal Vulnerability Allows Local File Read
Summary
CVE-2026-26329: OpenClaw has a path traversal in browser upload allows local file read. Affects openclaw versions < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source tool designed for managing and interacting with various web applications through a browser interface. It provides functionalities such as file uploads and browser automation. However, it has a critical vulnerability that allows authenticated attackers to exploit path traversal issues, leading to unauthorized access to local files on the Gateway host.
Vulnerability Detail
The vulnerability arises from the lack of validation on file paths supplied during the browser tool's upload action. Authenticated attackers can manipulate these paths to read arbitrary files from the server's filesystem. This issue is particularly concerning as it allows for the exfiltration of sensitive information, compromising the confidentiality of the Gateway host. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) and has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the Gateway HTTP surface to trusted networks only. Ensure that the browser tool is not enabled for untrusted sessions, and consider implementing additional authentication mechanisms to safeguard against unauthorized access.
Conclusion
The OpenClaw vulnerability CVE-2026-26329 poses a significant risk due to its potential for unauthorized file access. It is crucial for users to update to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities effectively.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows authenticated users to perform path traversal attacks, enabling them to read arbitrary files from the server's filesystem.
Any user of OpenClaw versions prior to 2026.2.14 who has access to the browser tool is potentially affected.
You can use Vulert's playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
If an immediate update is not possible, restrict access to the Gateway and disable the browser tool for untrusted sessions as a temporary workaround.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
