OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read
Date: 2026-04
Affected: npm/openclaw
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-32846
CWE: CWE-22
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

## Summary OpenClaw <= 2026.3.24 Media Parsing Path Traversal to Arbitrary File Read ## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.24` - Patched versions: `>= 2026.3.28` - First stable tag containing the fix: `v2026.3.28` ## Fix Commit(s) - `4797bbc5b96e2cca5532e43b58915c051746fe37` — 2026-03-25T13:35:16-06:00 ## Release Process Note - The fix is already present in released version `2026.3.28`.


Mitigations:

Architectural layers (MAESTRO):