OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation.
Date: 2026-04
Affected: openclaw/openclaw
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-32002
CVE-2026-34426
CVE-2026-34510
CVE-2026-35618
CVE-2026-35620
CVE-2026-35622
CVE-2026-35624
CVE-2026-35626
CVE-2026-35627
CVE-2026-35631
CVE-2026-35633
CVE-2026-35634
CVE-2026-35635
CVE-2026-35637
CVE-2026-35638
CVE-2026-35639
CVE-2026-35643
CVE-2026-35644
CVE-2026-35648
CVE-2026-35649
CVE-2026-35650
CVE-2026-35652
CVE-2026-35655
CVE-2026-35656
CVE-2026-35658
CVE-2026-35659
CVE-2026-35660
CVE-2026-35662
CVE-2026-35666
CVE-2026-35670
CVE-2026-41387
CWE: CWE-15
CWE-178
CWE-183
CWE-184
CWE-200
CWE-212
CWE-286
CWE-288
CWE-290
CWE-294
CWE-312
CWE-345
CWE-367
CWE-405
CWE-41
CWE-522
CWE-648
CWE-668
CWE-696
CWE-706
CWE-770
CWE-789
CWE-807
CWE-862
CWE-863
CWE-940
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended access restrictions.


Mitigations:

Architectural layers (MAESTRO):