CVE-2026-33581Withdrawn

OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters

CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMEUVD CVSS 4.0 7.1 CVSS 4.0 · [email protected] · Secondary 7.1 HIGHCVSS 3.1 · [email protected] · Secondary 6.5 MEDIUMCVSS 3.1 · [email protected] · Primary 8.6 HIGHCVSS_V3 CVSS_V4 Publisher rating HIGHFixed by openclaw 2026.3.24CVSS_V3 CVSS_V4 Publisher rating HIGHFixed by openclaw 2026.3.24KEV status unknown

Original advisory

cve-program · CVE-2026-33581

Published

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.

Read the publisher's advisory

euvd · EUVD-2026-17441

Published

Read the publisher's advisory

nvd · CVE-2026-33581

Published

Read the publisher's advisory

osv · GHSA-3gr8-2752-h46q

Withdrawn

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v8wv-jg3q-qwpq. This link is maintained to preserve external references. ### Original Description OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.

Read the publisher's advisory

osv · GHSA-v8wv-jg3q-qwpq

Published

## Summary The message tool accepted `mediaUrl` and `fileUrl` aliases without applying the same sandbox localRoots validation as the canonical media path handling. ## Impact A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters. ## Affected Component `src/infra/outbound/message-action-params.ts, src/infra/outbound/message-action-runner.ts` ## Fixed Versions - Affected: `< 2026.3.24` - Patched: `>= 2026.3.24` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `1d7cb6fc03` (`fix: close sandbox media root bypass for mediaUrl/fileUrl aliases`). OpenClaw thanks @AntAISecurityLab for reporting.

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Risk history

Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.

When does an EPSS score appear as a change?

A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.

Advisory history

12 saved versions

See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.

How advisory history works

Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.

11 Nov 2026 08:38:06 UTC