CVE-2026-33581 in OpenClaw
Résumé (Anglaise)
OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Responsable
VulnCheck
Réserver
23/03/2026
Divulgation
31/03/2026
Statut
Confirmé
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354406 | OpenClaw directory traversal | 22 | Non défini | Correctif officiel | CVE-2026-33581 |