CVE-2026-22180
OpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 4.8EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
18 mar 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directories. Attackers can exploit insufficient canonical path-boundary validation in file write operations to escape root-bound restrictions and write files to arbitrary locations.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
OpenClaw · OpenClaw¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →