CVE-2026-27522: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-27522 is a path traversal vulnerability (local media root bypass) in OpenClaw, an npm-distributed Node.js package, affecting all versions prior to 2026.2.24. When the sandboxRoot configuration option is unset, the sendAttachment and setGroupIcon message actions fail to enforce local media root restrictions, allowing authenticated attackers to supply absolute host file paths for media hydration. The vulnerability was reported by researcher GCXWLP, disclosed via a GitHub Security Advisory on February 25, 2026, and assigned CVE-2026-27522 on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal), compounded by CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In the vulnerable code path within src/infra/outbound/message-action-params.ts, the hydrateAttachmentPayload function called loadWebMedia with sandboxValidated: true regardless of whether sandboxRoot was actually configured, effectively bypassing the intended local media root enforcement when sandboxRoot was absent. An authenticated attacker with low privileges who can trigger a sendAttachment or setGroupIcon message action can supply a local absolute file path (e.g., /etc/passwd) as the media parameter; the runtime then reads and returns the file contents without restriction. The fix, committed as 270ab03, conditionally applies localRoots constraints when sandboxRoot is unset and passes mediaLocalRoots derived from agent-scoped configuration into both hydration functions (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker with low privileges to read arbitrary files on the host system that are accessible to the user account running the OpenClaw runtime. Sensitive files such as credentials, configuration files, private keys, or application secrets could be exfiltrated via the media hydration response. There is no integrity or availability impact; the vulnerability is limited to confidentiality, but the data exposure risk is significant in environments where OpenClaw runs with broad filesystem access (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with low privileges and the ability to trigger message actions, limiting the attack surface compared to unauthenticated vulnerabilities (Feedly, GitHub Advisory).

1. Identify a vulnerable deployment: Confirm the target is running OpenClaw (npm) version ≤ 2026.2.23 and that sandboxRoot is not configured in the deployment settings.
2. Obtain authenticated access: Acquire credentials or a session token for an account with low privileges that is authorized to trigger message actions (e.g., sendAttachment or setGroupIcon).
3. Craft a malicious message action request: Construct an API or message action call targeting sendAttachment or setGroupIcon, setting the media parameter to a local absolute path of a sensitive file (e.g., /etc/passwd, /home/user/.ssh/id_rsa, or application config files).
4. Trigger media hydration: Submit the crafted request. Because sandboxRoot is unset, the hydrateAttachmentPayload function calls loadWebMedia without localRoots enforcement, causing the runtime to read the specified file from the host filesystem.
5. Retrieve file contents: The file contents are base64-encoded into the buffer field of the action parameters and returned in the response, allowing the attacker to decode and exfiltrate the data (GitHub Advisory, Fix Commit).

• Logs: Application logs showing sendAttachment or setGroupIcon message action calls with media parameters containing absolute host paths (e.g., /etc/, /home/, /root/, /var/) rather than relative or sandbox-scoped paths.
• Logs: Repeated or unusual invocations of attachment hydration functions from low-privilege accounts, particularly targeting sensitive system directories.
• File System: Evidence of file reads on sensitive paths (e.g., /etc/passwd, /etc/shadow, SSH key files, .env files) by the OpenClaw runtime process, visible in OS-level audit logs (e.g., Linux auditd with file-read rules).
• Network: Outbound data transfers containing base64-encoded content shortly after message action API calls, potentially indicating exfiltration of file contents retrieved via the vulnerability.

Upgrade OpenClaw (npm) to version 2026.2.24 or later, which enforces local media root checks for sendAttachment and setGroupIcon regardless of sandboxRoot configuration (Fix Commit, GitHub Advisory). As a defense-in-depth measure prior to patching, explicitly configure sandboxRoot in all OpenClaw deployments to activate the existing sandbox path enforcement. Additionally, restrict network and API access to OpenClaw services to trusted users only, and review access logs for suspicious sendAttachment or setGroupIcon calls referencing absolute host paths.