Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-32846

CVE-2026-32846HIGH

OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0073   53.5     —

AFFECTED
  Product   Versions     Fixed
  OpenClaw  unspecified  2026.3.28

TIMELINE
  Mar 16  Reserved by VulnCheck
  Mar 26  Published (CNA: VulnCheck)
  Oct 8   EXPLOIT PUBLISHED — CVE-2026-32846 (OpenClaw). Public exploit reference added.

CWE-22 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Modified

Description

OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
March 16, 2026	Reserved	Reserved by VulnCheck
March 26, 2026	Published	Published (CNA: VulnCheck)
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-32846 (OpenClaw). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
OpenClaw	OpenClaw	—	—	2026.3.28

Weaknesses

CWE-22

References (4)

https://github.com/openclaw/openclaw/commit/4797bbc5b96e2cca5532e43b58915c051746fe37 [Patch]
https://github.com/openclaw/openclaw/pull/54642 [Exploit, Issue Tracking, Vendor Advisory]
https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94r [Broken Link]
https://www.vulncheck.com/advisories/openclaw-media-parsing-path-traversal-to-arbitrary-file-read [Third Party Advisory]

Authoritative record: CVE-2026-32846 at cve.org

Vendors: openclaw

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-32846 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.