CVE-2026-27522

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-275237.5OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-p CVE-2026-275244.3OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype polluti CVE-2026-27537.5An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize us CVE-2026-275357.1Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.CVE-2026-275367.1Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.CVE-2026-275376.5Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.CVE-2026-275387.5Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-275397.1Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.CVE-2026-27547.5Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated r CVE-2026-275409.0Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-whole CVE-2026-275417.2Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This CVE-2026-275429.8Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture