CVE-2026-100536CWE-22path-traversal

CVE-2026-100536

Medium · published September 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause Telegram delivery to read and send known host files that would otherwise be rejected.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-26T07:16Z
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-fphf-69cp-h5xw · [email protected]https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-path-traversal-via-structured-attachments · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 02:18Z
    OpenClaw before 2026.8.1 Path Traversal via Structured Attachments
    cvelistv5