{"id":"CVE-2026-32033","aliases":["GHSA-27cr-4p5m-74rj"],"url":"https://o3.security/vulnerability/CVE-2026-32033","summary":"OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation","details":"OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due to canonicalization mismatch. Attackers can exploit this by crafting @-prefixed paths like @/etc/passwd to read files outside the intended workspace boundary when tools.fs.workspaceOnly is enabled.","published":"2026-03-19T22:07:08.552Z","modified":"2026-08-17T03:55:01.617815551Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.24"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260","label":"openclaw/openclaw@9ef0fc2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32033.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32033"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-path-traversal-via-prefixed-absolute-paths-in-workspace-boundary-validation"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-17T03:55:01.617815551Z"}}