PT-2026-49029

CVE-2026-53825

Published

2026-06-12

Updated

2026-07-02

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.7

Description The memory-wiki ingest feature allows authenticated Gateway operators with operator.write scope to read local files outside of the intended ingest sources. By specifying arbitrary local file paths, an attacker with these permissions can import file content into the wiki memory, bypassing established access restrictions.

Recommendations Update to version 2026.4.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

CWE-732: Incorrect Permission Assignment for Critical Resource

Related identifiers