{"id":"CVE-2026-32026","aliases":["GHSA-33hm-cq8r-wc49"],"url":"https://o3.security/vulnerability/CVE-2026-32026","summary":"OpenClaw < 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandbox","details":"### Summary\nSandbox media local-path validation accepted absolute paths under host tmp, even when those paths were outside the active sandbox root.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published version verified during triage: `2026.2.23`\n- Affected versions: `<= 2026.2.23`\n- Patched versions (planned next release): `>= 2026.2.24`\n\n### Details\nIn affected versions, sandbox media path resolution allowed absolute host tmp paths as trusted media inputs when they were under `os.tmpdir()`, without requiring that the path stay within the active `sandboxRoot`.\nBecause outbound attachment hydration consumed these paths as already validated, this enabled out-of-sandbox host tmp file reads and exfiltration through attachment delivery.\n\n### Impact\n- Confidentiality impact: high for deployments relying on `sandboxRoot` as a strict local filesystem boundary.\n- Practical impact: attacker-controlled media references could read and attach host tmp files outside the sandbox workspace boundary.\n\n### Remediation\n- Restrict sandbox tmp-path acceptance to OpenClaw-managed temp roots only.\n- Default SDK/extension temp helpers to OpenClaw-managed temp roots.\n- Add CI guardrails to prevent broad tmp-root regressions in messaging/channel code paths.\n\n### Fix Commit(s)\n- `d3da67c7a9b463edc1a9b1c1f7af107a34ca32f5`\n- `79a7b3d22ef92e36a4031093d80a0acb0d82f351`\n- `def993dbd843ff28f2b3bad5cc24603874ba9f1e`\n\n### Release Process Note\nThe advisory is pre-set with patched version `2026.2.24` so it is ready for publication once that npm release is available.\n\nOpenClaw thanks @tdjackey for reporting.\n\n\n### Publication Update (2026-02-25)\n`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.","published":"2026-03-19T22:07:02.148Z","modified":"2026-08-17T03:55:01.704485652Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.24"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/79a7b3d22ef92e36a4031093d80a0acb0d82f351","label":"openclaw/openclaw@79a7b3d"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32026.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-33hm-cq8r-wc49"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32026"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-improper-temporary-path-validation-in-sandbox"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/79a7b3d22ef92e36a4031093d80a0acb0d82f351"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/d3da67c7a9b463edc1a9b1c1f7af107a34ca32f5"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/def993dbd843ff28f2b3bad5cc24603874ba9f1e"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-17T03:55:01.704485652Z"}}