Vulnerability Description
OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file paths to import file content into wiki memory, bypassing access restrictions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.4.7 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-p2fh-f5fc-44hrMitigationVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-arbitrary-local-file-read-via-memoThird Party Advisory
FAQ
What is CVE-2026-53825?
CVE-2026-53825 is a vulnerability with a CVSS score of 6.5 (MEDIUM). OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outsi...
How severe is CVE-2026-53825?
CVE-2026-53825 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53825?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.