CVE-2026-33581CWE-22

OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters

High · published March 31, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00637 · 49.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-31T14:10Z
EPSS history
Timeline
  • 31 MAR 14:10Z
    OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
    cvelistv5