Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
OpenClaw: Malicious Files Can Be Read from Anywhere on the System
GHSA-58q2-7r52-jq62
Summary
OpenClaw, a library used by many applications, has a security flaw that allows hackers to read any file on a computer. This could expose sensitive information. To fix this, update OpenClaw to version 2026.3.31 or later.
What to do
- Update openclaw to version 2026.3.31.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| – | openclaw | <= 2026.3.28 | 2026.3.31 |
Original title
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read
Original description
## Summary
Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read
## Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 ACP dispatch still reads attachment paths outside the guarded attachment-cache or root checks, and the root-enforcement fix is not yet shipped.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`
## Fix Commit(s)
- `566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d` — 2026-03-30T14:04:02+01:00
OpenClaw thanks @north-echo for reporting.
Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read
## Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 ACP dispatch still reads attachment paths outside the guarded attachment-cache or root checks, and the root-enforcement fix is not yet shipped.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`
## Fix Commit(s)
- `566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d` — 2026-03-30T14:04:02+01:00
OpenClaw thanks @north-echo for reporting.
ghsa CVSS4.0
5.3
Vulnerability type
CWE-22
Path Traversal
Published: 3 Apr 2026 · Updated: 3 Apr 2026 · First seen: 3 Apr 2026