CVE-2026-26329: OpenClaw has a path traversal in browser upload allows local file read
(updated )
Authenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool’s upload action. The server passed these paths to Playwright’s setInputFiles() APIs without restricting them to a safe root.
Severity remains High due to the impact (arbitrary local file read on the Gateway host), even though exploitation requires authenticated access.
References
- github.com/advisories/GHSA-cv7m-c9jx-vg7q
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87
- github.com/openclaw/openclaw/releases/tag/v2026.2.14
- github.com/openclaw/openclaw/security/advisories/GHSA-cv7m-c9jx-vg7q
- nvd.nist.gov/vuln/detail/CVE-2026-26329
Code Behaviors & Features
Detect and mitigate CVE-2026-26329 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →