CVE-2026-27522 — MEDIUM (6.5)

Q: How severe is CVE-2026-27522?

CVE-2026-27522 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-27522?

Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.

Vulnerability Description

OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Openclaw	Openclaw	< 2026.2.24

Related Weaknesses (CWE)

CWE-22

References

https://github.com/openclaw/openclaw/commit/270ab03e379f9653e15f7033c9830399b66bPatch
https://github.com/openclaw/openclaw/security/advisories/GHSA-fqcm-97m6-w7rmPatchVendor Advisory
https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-sendattachThird Party Advisory

FAQ

What is CVE-2026-27522?

CVE-2026-27522 is a vulnerability with a CVSS score of 6.5 (MEDIUM). OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from loca...

How severe is CVE-2026-27522?

CVE-2026-27522 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-27522?

Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.