CVE-2026-53825

6.5 Moyenne

Publiée le 13/06/2026 à 00:16 · Modifiée le 23/07/2026 à 11:10 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file paths to import file content into wiki memory, bypassing access restrictions.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.5 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/openclaw/openclaw/security/advisories/GHSA-p2fh-f5fc-44hr MitigationVendor Advisory
https://www.vulncheck.com/advisories/openclaw-arbitrary-local-file-read-via-memory-wiki-ingest-with-operator-write-scope Third Party Advisory

CVE-2026-53825

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs