CVE-2026-32060: OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in applypatch that allows attackers to write or delete files outside the configured workspace directory. When applypatch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32060?
CVE-2026-32060 is rated as a medium severity vulnerability.
How do I fix CVE-2026-32060?
To fix CVE-2026-32060, upgrade OpenClaw to version 2026.2.14 or later.
What systems are affected by CVE-2026-32060?
CVE-2026-32060 affects all versions of OpenClaw prior to 2026.2.14.
What type of vulnerability is CVE-2026-32060?
CVE-2026-32060 is a path traversal vulnerability in the apply_patch function.
What can an attacker achieve with CVE-2026-32060?
An attacker exploiting CVE-2026-32060 can write or delete files outside the configured workspace directory.