PT-2026-49029 · Openclaw · Openclaw
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.4.7
Description
The memory-wiki ingest feature allows authenticated Gateway operators with
operator.write scope to read local files outside of the intended ingest sources. By specifying arbitrary local file paths, an attacker with these permissions can import file content into the wiki memory, bypassing established access restrictions.Recommendations
Update to version 2026.4.7 or later.
Exploit
Fix
Path traversal
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw