QSearchQSearch

CVE-2026-53813

7.8 HIGH

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local ...

Published: 2026-06-11 · Last updated: 2026-06-12

Severity and scoring

CVSS
7.8 HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-427

Affected products

VendorProduct
openclawopenclaw

Description

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts from unintended local locations, potentially executing malicious code or accessing sensitive data.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-53819 — OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can overri... (8.8 HIGH)
  • CVE-2026-53818 — OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to ski... (6.6 MEDIUM)
  • CVE-2026-53817 — OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to... (8.8 HIGH)
  • CVE-2026-53816 — OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to... (7.2 HIGH)
  • CVE-2026-53815 — OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks (6.5 MEDIUM)

Same CWE

  • CVE-2026-11967 — MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL locat...
  • CVE-2026-11879 — MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a...
  • CVE-2026-7870 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call (8.8 HIGH)
  • CVE-2026-10847 — A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS (7.8 HIGH)
  • CVE-2026-8637 — A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local auth... (7.8 HIGH)