Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-43533 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-43533 is an arbitrary file read vulnerability affecting OpenClaw versions prior to 2026.4.10, specifically in the QQBot media tags component. The flaw allows attackers to reference host-local paths outside the intended media storage boundary by crafting malicious reply text containing media tags, which leads to disclosure of arbitrary local files through outbound media handling. It has been assigned CWE-23 (Relative Path Traversal) and a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, no required privileges or user interaction, and significant confidentiality impact in a scoped context. The vulnerability was published on 2026-05-05.
Remote attackers without authentication can exploit this vulnerability by sending specially crafted reply text with malicious media tags to an affected OpenClaw instance. Successful exploitation enables the attacker to read arbitrary files on the host system, potentially exposing sensitive data such as configuration files, credentials, or other local resources accessible to the OpenClaw process.
Advisories from GitHub (GHSA-66r7-m7xm-v49h) and VulnCheck detail the issue, with a fixing commit (604777e4414cc3b2ff8861f18f4fb04374c702c6) available in the OpenClaw repository. Mitigation involves upgrading to OpenClaw 2026.4.10 or later, where the media tag path validation has been strengthened to prevent traversal outside the storage boundary.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27277
Vulnerability Data
OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text containing media tags to disclose arbitrary local files…
more
through outbound media handling.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Explicit validation of path inputs stops .. sequences from ever being interpreted by the file system.
Access enforcement directly blocks unauthorized file reads/writes that result from unresolved .. sequences.
Information-flow rules can be configured to reject traversals that would move data outside an approved directory boundary.
Least privilege reduces the set of reachable files even when a traversal succeeds.
Secure-engineering principles require safe pathname construction and input neutralization before any file operation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.
Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.
Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.
Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.