cve.bz

CVE-2026-35658

6.0 mediumEPSS 0.3%

Medium (6.0) in openclaw openclaw. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.2.

OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tools would reject.

Severity

CVSS 4.0

6.0 medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE
CWE-668
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-cfp9-w5v9-3q4hnpmopenclaw<2026.3.22026.3.2

References

Check your stackJSON