CVE-2026-32033

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32033
OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due to canonicalization mismatch. Attackers can exploit this by crafting @-prefixed paths like @/etc/passwd to read files outside the intended workspace boundary when tools.fs.workspaceOnly is enabled.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-path-traversal-via-prefixed-absolute-paths-in-workspace-boundary-validation Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

25 Mar 2026, 15:16

Type Values Removed Values Added
Summary
  • (es) Versiones de OpenClaw anteriores a 2026.2.24 contienen una vulnerabilidad de salto de ruta donde las rutas absolutas con prefijo '@' eluden la validación de límites del sistema de archivos solo para el espacio de trabajo debido a una falta de coincidencia en la canonización. Los atacantes pueden explotar esto creando rutas con prefijo '@' como @/etc /passwd para leer archivos fuera del límite del espacio de trabajo previsto cuando tools.fs.workspaceOnly está habilitado.
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 6.5

23 Mar 2026, 14:56

Type Values Removed Values Added
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
First Time Openclaw openclaw
Openclaw
References () https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260 - () https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260 - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj - () https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj - Vendor Advisory
References () https://www.vulncheck.com/advisories/openclaw-path-traversal-via-prefixed-absolute-paths-in-workspace-boundary-validation - () https://www.vulncheck.com/advisories/openclaw-path-traversal-via-prefixed-absolute-paths-in-workspace-boundary-validation - Third Party Advisory

19 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-19 22:16

Updated : 2026-03-25 15:16

NVD link : CVE-2026-32033

Mitre link : CVE-2026-32033

CVE.ORG link : CVE-2026-32033

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')