CVE Catalog
CVE-2026-41370
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.42%
34th percentile - higher than 34% of all known CVEs
Summary
OpenClaw before version 2026.3.31 contains a path traversal vulnerability in the ACP dispatch component. Attackers can read arbitrary files by manipulating inbound channel attachment paths, bypassing access controls.
Risk Assessment
The risk is unauthorized file reading outside intended directories, potentially leading to data leakage.
Recommendation
Upgrade OpenClaw to version 2026.3.31 or later, which contains the fix.
Original NVD description (English source)
OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths. Remote attackers can bypass attachment-cache and root directory checks to access files outside intended directories.