{"id":"CVE-2026-27522","aliases":["EUVD-2026-12732","GHSA-fqcm-97m6-w7rm"],"status":"published","title":"OpenClaw \u003c 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions","description":"OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00395,"percentile":0.34179,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-22"],"published":"2026-03-02T23:34:02Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.2.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2026.2.23"},{"fixed":"2026.2.24"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.24"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fqcm-97m6-w7rm","tags":["vendor-advisory","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/commit/270ab03e379f9653e15f7033c9830399b66b7e51","tags":["patch","Patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-sendattachment-and-setgroupicon-message-actions","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27522","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fqcm-97m6-w7rm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27522.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27522","title":"OpenClaw \u003c 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions","description":"OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.","status":"published","published":"2026-03-18T01:34:26.28Z","modified":"2026-06-23T16:14:07.608Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-12732","description":"OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.","status":"published","published":"2026-03-18T01:34:26Z","modified":"2026-06-23T16:14:07Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-fqcm-97m6-w7rm","title":"OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset","description":"## Impact\n`sendAttachment` and `setGroupIcon` message actions could hydrate media from local absolute paths when `sandboxRoot` was unset, bypassing intended local media root checks. This could allow reads of arbitrary host files reachable by the runtime user when an authorized message-action path was triggered.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version at triage: `2026.2.23`\n- Vulnerable: `\u003c= 2026.2.23`\n- Patched in code: `\u003e= 2026.2.24` (planned next release)\n\n## Remediation\nUpgrade to `openclaw` `2026.2.24` or later once published.\n\n## Fix Commit(s)\n- 270ab03e379f9653e15f7033c9830399b66b7e51\n\n## Release Process Note\n`patched_versions` is pre-set to the planned next release (`\u003e= 2026.2.24`). Once that npm release is published, this advisory can be published without further field edits.\n\nOpenClaw thanks @GCXWLP for reporting.\n\n\n### Publication Update (2026-02-25)\n`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `\u003e= 2026.2.24` as patched.","status":"published","published":"2026-03-02T23:34:02Z","modified":"2026-03-18T21:50:05Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"nvd":[{"id":"CVE-2026-27522","description":"OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.","status":"published","published":"2026-03-18T02:16:23.22Z","modified":"2026-06-17T10:27:18.213Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-27522","title":"OpenClaw \u003c 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions","description":"OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.","status":"published","published":"2026-03-18T01:34:26.28Z","modified":"2026-10-28T02:30:48.959544753Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"GHSA-fqcm-97m6-w7rm","title":"OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset","description":"## Impact\n`sendAttachment` and `setGroupIcon` message actions could hydrate media from local absolute paths when `sandboxRoot` was unset, bypassing intended local media root checks. This could allow reads of arbitrary host files reachable by the runtime user when an authorized message-action path was triggered.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version at triage: `2026.2.23`\n- Vulnerable: `\u003c= 2026.2.23`\n- Patched in code: `\u003e= 2026.2.24` (planned next release)\n\n## Remediation\nUpgrade to `openclaw` `2026.2.24` or later once published.\n\n## Fix Commit(s)\n- 270ab03e379f9653e15f7033c9830399b66b7e51\n\n## Release Process Note\n`patched_versions` is pre-set to the planned next release (`\u003e= 2026.2.24`). Once that npm release is published, this advisory can be published without further field edits.\n\nOpenClaw thanks @GCXWLP for reporting.\n\n\n### Publication Update (2026-02-25)\n`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `\u003e= 2026.2.24` as patched.","status":"published","published":"2026-03-02T23:34:02Z","modified":"2026-03-18T22:02:27.123465Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}