6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33581

CVE-2026-33581: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

Summary

The message tool accepted mediaUrl and fileUrl aliases without applying the same sandbox localRoots validation as the canonical media path handling.

Impact

A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters.

Affected Component

src/infra/outbound/message-action-params.ts, src/infra/outbound/message-action-runner.ts

Fixed Versions

Affected: < 2026.3.24
Patched: >= 2026.3.24
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 1d7cb6fc03 (fix: close sandbox media root bypass for mediaUrl/fileUrl aliases).

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33581

CVE-2026-33581:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.3.24	2026.3.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in OpenClaw's message tool. The root cause lies in the normalizeSandboxMediaParams function, which was designed to restrict file access to a specific sandbox directory. However, this function failed to validate the mediaUrl and fileUrl parameter aliases, checking only the media, path, and filePath parameters.

An attacker could exploit this by crafting a request that uses mediaUrl or fileUrl with a file:// URI to point to an arbitrary file on the local filesystem (e.g., file:///etc/passwd). The normalizeSandboxMediaParams function would not apply its sandbox validation to this parameter, allowing the unsanitized path to be processed by downstream functions like handleSendAction.

The patch addresses this by expanding the list of parameters that normalizeSandboxMediaParams validates to include mediaUrl and fileUrl. This ensures that any local file paths provided through these aliases are correctly resolved against the sandbox root, preventing the traversal. The identified functions are all part of this vulnerable workflow, with normalizeSandboxMediaParams being the source of the flaw and runMessageAction and handleSendAction being key functions in the execution path that would appear in a runtime profile during exploitation.

Vulnerable functions

normalizeSandboxMediaParams

src/infra/outbound/message-action-params.ts

This function was responsible for ensuring that file paths provided in media parameters were within the allowed sandbox directory. However, it only checked the 'media', 'path', and 'filePath' parameters, completely ignoring the 'mediaUrl' and 'fileUrl' aliases. An attacker could provide a path to a sensitive file outside the sandbox using 'mediaUrl' or 'fileUrl' (e.g., 'file:///etc/passwd'), and this function would not validate it, leading to arbitrary file read.

handleSendAction

src/infra/outbound/message-action-runner.ts

This function processes parameters for sending messages and attachments. While not the source of the validation bypass, it is a key component in the vulnerable execution flow. It reads the `mediaUrl` and `fileUrl` parameters, which, prior to the patch, were not being properly sanitized by `normalizeSandboxMediaParams`. Therefore, this function would process the malicious, unsanitized file path, making it a clear indicator in a runtime profile during exploitation.

runMessageAction

src/infra/outbound/message-action-runner.ts

This is the main entry point function that orchestrates the execution of various message-related actions. It receives the user-controlled parameters, including the potentially malicious 'mediaUrl' or 'fileUrl', and routes them to the appropriate handlers like `handleSendAction`. As the top-level function in the call stack for this operation, it would appear in any runtime profile when the vulnerability is triggered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.