https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T10:27:42.732498+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41370 BREW-openclaw-cli-CVE-2026-41370 — OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read 2026-10-05T10:27:42.832891+00:00

Affected: Homebrew: openclaw-cli

## Summary Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read

## Current Maintainer Triage - Normalized severity: medium - Assessment: v2026.3.28 ACP dispatch still reads attachment paths outside the guarded attachment-cache or root checks, and the root-enforcement fix is not yet shipped.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d` — 2026-03-30T14:04:02+01:00

OpenClaw thanks @north-echo for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-307874 EUVD-2026-307874 2026-10-05T10:27:42.832975+00:00 EUVD-2026-307874 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41370 fkie_cve-2026-41370 2026-10-05T10:27:42.832998+00:00

OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths. Remote attackers can bypass attachment-cache and root directory checks to access files outside intended directories.

 https://cve.radiocsirt.org/vuln/ghsa-pmg8-9xxh-v2wv GHSA-pmg8-9xxh-v2wv 2026-10-05T10:27:42.833035+00:00

OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths. Remote attackers can bypass attachment-cache and root directory checks to access files outside intended directories.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-05T10:27:42.833062+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.