How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

349,003

Total vulnerabilities in the database

OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22) — openclaw

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

> Fixed in OpenClaw 2026.3.24, the current shipping release.

Advisory Details

Title: Sandbox Media Root Bypass via Unnormalized mediaUrl / fileUrl Parameter Keys (CWE-22)

Description:

Summary

A path traversal vulnerability in the agent sandbox enforcement allows a sandboxed agent to read arbitrary files from other agents' workspaces by using the mediaUrl or fileUrl parameter key in message tool calls. The normalizeSandboxMediaParams function only checks ["media", "path", "filePath"] keys, while mediaUrl and fileUrl escape normalization entirely. Combined with handlePluginAction dropping mediaLocalRoots from the dispatch context, this enables a full sandbox escape where any agent can read files outside its designated sandbox root.

Details

The vulnerability exists in two files within the messaging pipeline:

1. Incomplete parameter key coverage in normalizeSandboxMediaParams:

In src/infra/outbound/message-action-params.ts, the function iterates over a hardcoded allowlist of parameter keys to validate:

// Line 212
const mediaKeys: Array&lt;&quot;media&quot; | &quot;path&quot; | &quot;filePath&quot;&gt; = [&quot;media&quot;, &quot;path&quot;, &quot;filePath&quot;];

The mediaUrl and fileUrl parameter keys are not included in this array. These keys are actively used by multiple channel extensions (Discord, Telegram, Slack, Matrix, Twitch) for media attachment handling, but they completely bypass the sandbox path validation performed by resolveSandboxedMediaSource.

2. Dropped mediaLocalRoots in handlePluginAction:

In src/infra/outbound/message-action-runner.ts, the handlePluginAction function dispatches actions to channel plugins but omits mediaLocalRoots from the context:

// Lines 684-697
const handled = await dispatchChannelMessageAction({
    channel,
    action,
    cfg,
    params,
    accountId: accountId ?? undefined,
    requesterSenderId: input.requesterSenderId ?? undefined,
    sessionKey: input.sessionKey,
    sessionId: input.sessionId,
    agentId,
    gateway,
    toolContext: input.toolContext,
    dryRun,
    // mediaLocalRoots is MISSING here
});

Despite ChannelMessageActionContext defining mediaLocalRoots?: readonly string[] (in src/channels/plugins/types.core.ts line 478), plugins receive undefined and fall back to getDefaultMediaLocalRoots(), which permits reads of the entire ~/.openclaw/ directory tree — including all agents' workspaces.

Attack chain:

A sandboxed agent (Agent-A at ~/.openclaw/workspace/agent-a/) calls the message tool with { mediaUrl: "~/.openclaw/workspace/agent-b/secret.txt" }
normalizeSandboxMediaParams skips the mediaUrl key (not in allowlist)
handlePluginAction dispatches without mediaLocalRoots
Plugin calls loadWebMedia with default roots, which allows ~/.openclaw/workspace/**
Agent-B's secret file content is read and sent as a channel attachment

PoC

Prerequisites:

Docker installed
OpenClaw Docker image built (openclaw-gateway:latest)

Steps:

Start the vulnerable gateway container:

cd llm-enhance/cve-finding/Path_Traversal/CVE-2026-27522-Media_Root_Bypass-variant-exp/
docker compose up -d
sleep 5

Run the exploit:

python3 poc_exploit.py

The exploit writes a secret file to ~/.openclaw/workspace/agent-b/secret_key.txt inside the container, then invokes normalizeSandboxMediaParams with Agent-A's sandbox policy and { mediaUrl: <agent-b-secret-path> }. The mediaUrl key bypasses normalization, and loadWebMedia reads the file successfully.
Run the control experiment to confirm sandbox works for checked keys:

python3 control-sandbox_enforced.py

Log of Evidence

Exploit output:

=== CVE-2026-27522 Variant: Sandbox Media Root Bypass ===

[*] Container &#039;openclaw-media-bypass-test&#039; is running
[*] Running exploit script with Bun...

[VULNERABLE] mediaUrl bypassed normalizeSandboxMediaParams!
  Agent-A sandboxRoot: /root/.openclaw/workspace/agent-a
  mediaUrl targets Agent-B: /root/.openclaw/workspace/agent-b/secret_key.txt
  args after normalization: {&quot;mediaUrl&quot;:&quot;/root/.openclaw/workspace/agent-b/secret_key.txt&quot;}
[EXPLOITED] Agent-B secret file content: AGENT-B-SECRET-API-KEY-sk-12345abcdef

=== EXPLOIT SUCCESSFUL ===
Agent-A read Agent-B&#039;s secret file via mediaUrl, bypassing sandbox.

[+] RESULT: VULNERABLE — mediaUrl bypasses sandbox enforcement

Control experiment output:

=== Control Experiment: Sandbox Enforcement for &#039;media&#039; Key ===

[*] Container &#039;openclaw-media-bypass-test&#039; is running
[*] Running control script with Bun...

[SAFE] normalizeSandboxMediaParams blocked &#039;media&#039; key as expected!
  Error: Path escapes sandbox root (/tmp/sandbox-ZKvGQX): /tmp/victim-2cuAOO/secret.txt

=== CONTROL EXPERIMENT PASSED ===
The &#039;media&#039; parameter IS correctly checked by sandbox enforcement.
Only unchecked keys (mediaUrl, fileUrl) bypass the sandbox.

[+] CONTROL PASSED: &#039;media&#039; key is correctly enforced by sandbox

Impact

This is a sandbox escape vulnerability. An attacker who can influence an agent's tool calls (via prompt injection, multi-agent interaction, or malicious plugin instruction) can read arbitrary files from other agents' workspaces. This includes:

API keys and secrets stored in other agents' sandboxes
Session data and conversation logs
Configuration files with sensitive credentials
Any file within the ~/.openclaw/ directory tree

This completely defeats the purpose of the multi-agent sandbox isolation feature, which is documented as a security boundary in the project's Docker and sandboxing documentation.

Affected products

Ecosystem: npm
Package name: openclaw
Affected versions: <= 2026.3.14 (current latest)
Patched versions: <None>

Severity

Severity: High
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Occurrences

| Permalink | Description | | :--- | :--- | | https://github.com/moltbot/moltbot/blob/main/src/infra/outbound/message-action-params.ts#L206-L227 | The normalizeSandboxMediaParams function with incomplete mediaKeys allowlist — mediaUrl and fileUrl are not checked. | | https://github.com/moltbot/moltbot/blob/main/src/infra/outbound/message-action-runner.ts#L684-L697 | The handlePluginAction dispatch call that omits mediaLocalRoots from the context passed to dispatchChannelMessageAction. | | https://github.com/moltbot/moltbot/blob/main/src/channels/plugins/types.core.ts#L478 | The ChannelMessageActionContext type that defines mediaLocalRoots but never receives it from handlePluginAction. |

Published: Mar 30, 2026
Updated: Mar 31, 2026
GHSA: GHSA-hr5v-j9h9-xjhg
Severity: High
Exploit:
CISA KEV:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWEs:

CWE-22

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
openclaw	-	2026.3.24

https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.