CVE-2026-32060

High

Description

OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.

SeverityHigh

CVSS8.8

Exploit probability—

ProductOpenclaw

PublishedMar 11, 2026

First seenMar 11, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

openclaw openclaw2026.2.14 or later
openclaw2026.2.14 or later

Patches

github.com/openclaw/openclaw/commit/5544646a09c0121fca7d7093812dc2de8437c7f1

Vendor advisories

github.com/openclaw/openclaw/security/advisories/GHSA-r5fq-947m-xm57

Affected products

Product	Affected versions	Fixed in
openclaw openclaw	v < 2026.2.14	2026.2.14
openclawnpm	v < 2026.2.14	2026.2.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.