highVulnerability
GHSA-f6pf-4gjx-c94r
## Summary OpenClaw <= 2026.3.24 Media Parsing Path Traversal to Arbitrary File Read ## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.24` - Patched versions: `>= 2026.3.28` - First stable tag containing the fix: `v2026.3.28` ## Fix Commit(s) - `4797bbc5b96e2cca5532e43b58915c051746fe37` — 2026-03-25T13:35:16-06:00 ## Release Process Note - The fix is already present in released version `2026.3.28`.
Properties
- ghsa_id
- GHSA-f6pf-4gjx-c94r
- severity
- high
- summary
- OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read
- cve_id
- GHSA-f6pf-4gjx-c94r
- is_ghsa_only
- true
- ghsa_published
- 2026-04-03T03:05:07Z
- source_url
- https://github.com/advisories/GHSA-f6pf-4gjx-c94r
- ghsa_updated
- 2026-04-03T03:05:08Z
Related Entities (3)
AFFECTS (1)
→[Software]npm/OpenClaw
HAS_WEAKNESS (1)
→[Weakness]Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph