HarborGuard / CVE
Back to search
HIGHCVE-2026-32060Published Modified CNA VulnCheck

CVE-2026-32060: OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths

OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.

Metrics

CVSS v4.0
8.7
Severity
HIGH
Fixed in
2026.2.14
Affected Products
1

Fix available

2026.2.14
Patch commits
Affected packages
  • openclaw / openclaw
    < 2026.2.14 (from 0)
    Fixed in 2026.2.14
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N