{"id":"CVE-2026-35658","state":"PUBLISHED","title":"OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool","description":"OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.","publishedAt":"2026-04-10T16:03:20.067Z","updatedAt":"2026-06-23T16:16:13.657Z","severity":{"score":6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["OpenClaw OpenClaw"],"affected":[{"vendor":"OpenClaw","product":"OpenClaw","packageURL":"pkg:npm/openclaw","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.3.2","versionType":"semver"},{"version":"2026.3.2","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/openclaw/openclaw/security/advisories/GHSA-cfp9-w5v9-3q4h","https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2","https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87","https://github.com/openclaw/openclaw/commit/dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53","https://github.com/openclaw/openclaw/commit/14baadda2c456f3cf749f1f97e8678746a34a7f4","https://www.vulncheck.com/advisories/openclaw-filesystem-boundary-bypass-in-image-tool"],"weaknesses":["CWE-668"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/35xxx/CVE-2026-35658.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-35658","state":"PUBLISHED","datePublished":"2026-04-10T16:03:20.067Z","dateUpdated":"2026-06-23T16:16:13.657Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-04-04T12:31:57.498Z"},"containers":{"cna":{"title":"OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool","descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject."}],"affected":[{"vendor":"OpenClaw","product":"OpenClaw","packageURL":"pkg:npm/openclaw","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.3.2","versionType":"semver"},{"version":"2026.3.2","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cfp9-w5v9-3q4h","name":"GitHub Security Advisory (GHSA-cfp9-w5v9-3q4h)","tags":["vendor-advisory"]},{"url":"https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2","name":"Patch Commit #1","tags":["patch"]},{"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87","name":"Patch Commit #2","tags":["patch"]},{"url":"https://github.com/openclaw/openclaw/commit/dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53","name":"Patch Commit #3","tags":["patch"]},{"url":"https://github.com/openclaw/openclaw/commit/14baadda2c456f3cf749f1f97e8678746a34a7f4","name":"Patch Commit #4","tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/openclaw-filesystem-boundary-bypass-in-image-tool","name":"VulnCheck Advisory: OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","version":"3.1","baseSeverity":"MEDIUM","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-668","lang":"en","description":"CWE-668: Exposure of Resource to Wrong Sphere","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-06-23T16:16:13.657Z"},"tags":["x_open-source"],"datePublic":"2026-03-24T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2026.3.2"}]}]}],"credits":[{"lang":"en","value":"Edward-x (@YLChen-007)","type":"reporter"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-14T14:56:25.542122Z","id":"CVE-2026-35658","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-14T14:56:40.942Z"}}]}}}