CVE-2026-100533

MEDIUMCVSS 5.3

Description

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the configured workspace boundary.

Timeline

Published:September 26th, 2026 3:16 AM

Last modified:September 29th, 2026 6:17 PM

CVSS Scoring

CVSS v3: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-path-traversal-via-unicode-fallback

Source: NIST NVD · Data may lag official sources by up to one minute