Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-34510
5.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): NONE
- Availability impact (A): NONE
OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders
OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended access restrictions.
References
-
GitHub Security Advisory (GHSA-h3x4-hc5v-v2gm) vendor-advisory
-
Patch Commit #1 patch
-
Patch Commit #2 patch
-
Patch Commit #3 patch
-
https://www.vulncheck.com/advisories/openclaw-remote-file-url-acceptance-in-win… third-party-advisory
Affected products
OpenClaw
- <2026.3.22
- ==2026.3.22
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>