AI agent vulnerability · OpenClaw

GHSA-f6pf-4gjx-c94r: OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read

highCVSS 4.0 7.1

Summary OpenClaw = 2026.3.28 - First stable tag containing the fix: v2026.3.28 Fix Commit(s) - 4797bbc5b96e2cca5532e43b58915c051746fe37 — 2026-03-25T13:35:16-06:00 Release Process Note - The fix is already present in released version 2026.3.28.

Published Apr 3, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.3.24
Fixed in: 2026.3.28
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

OpenClaw <= 2026.3.24 Media Parsing Path Traversal to Arbitrary File Read

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.24
Patched versions: >= 2026.3.28
First stable tag containing the fix: v2026.3.28

Fix Commit(s)

4797bbc5b96e2cca5532e43b58915c051746fe37 — 2026-03-25T13:35:16-06:00

Release Process Note

The fix is already present in released version 2026.3.28.

Credited to wsparks-vc, iskindar.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries