CVE-2026-53825

6.5 MEDIUM

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gatewa...

Published: 2026-06-12 · Last updated: 2026-06-12

Severity and scoring

CVSS: 6.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-22

Description

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file paths to import file content into wiki memory, bypassing access restrictions.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-12089 — The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, an... (4.9 MEDIUM)
CVE-2026-11442 — Allegra exportReport Directory Traversal Information Disclosure Vulnerability (6.5 MEDIUM)
CVE-2026-53519 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool (9.1 CRITICAL)
CVE-2026-54394 — MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo
CVE-2026-45775 — Discourse is an open-source discussion platform (6.8 MEDIUM)