CVE-2026-53865
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations.
Risk Assessment
This vulnerability may lead to unauthorized execution of local applications, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update OpenClaw to version 2026.5.2 or later to mitigate this vulnerability and to review and restrict access to environment paths used in maintenance tasks.
Original NVD description (English source)
OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by manipulating workspace-derived environment paths.