CVE-2026-33581: OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
Summary
The message tool accepted mediaUrl and fileUrl aliases without applying the same sandbox localRoots validation as the canonical media path handling.
Impact
A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters.
Affected Component
src/infra/outbound/message-action-params.ts, src/infra/outbound/message-action-runner.ts
Fixed Versions
- Affected: < 2026.3.24 - Patched: >= 2026.3.24 - Latest stable 2026.3.28 contains the fix.
Fix
Fixed by commit 1d7cb6fc03 (fix: close sandbox media root bypass for mediaUrl/fileUrl aliases).
Other sources
OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.3.24 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.3.28Patch 1d7cb6fc03
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33581?
CVE-2026-33581 has been classified as a high severity vulnerability due to its potential for arbitrary file reading.
How do I fix CVE-2026-33581?
To fix CVE-2026-33581, update OpenClaw to version 2026.3.24 or later to ensure localRoots validation is properly enforced.
What are the risks associated with CVE-2026-33581?
The risks include unauthorized access to sensitive files on the server, potentially leading to data breaches.
Which versions of OpenClaw are affected by CVE-2026-33581?
OpenClaw versions prior to 2026.3.24 are affected by CVE-2026-33581.
What components are involved in CVE-2026-33581?
CVE-2026-33581 involves the message tool and specifically the mediaUrl and fileUrl parameters.