CVE-2026-53813
Analyzed Analyzed - Analysis Complete

Path Traversal in OpenClaw Memory-Core Artifact Loading

Publication date: 2026-06-11

Last updated on: 2026-06-12

Assigner: VulnCheck

Description
OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts from unintended local locations, potentially executing malicious code or accessing sensitive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-11
Last Modified
2026-06-12
Generated
2026-07-02
AI Q&A
2026-06-12
EPSS Evaluated
2026-06-30
NVD
CVE-2026-53813

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.4.25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions before 2026.4.25 and involves a path traversal issue during the loading of memory-core artifacts. The problem arises because the workspace state affects how the local package root is resolved. As a result, attackers who have access to the affected workspaces can exploit this flaw to load memory-core artifacts from unintended local locations.

This can allow attackers to execute malicious code or access sensitive data by tricking the system into loading harmful or unauthorized files.

Impact Analysis

The vulnerability can have serious impacts including unauthorized execution of malicious code and unauthorized access to sensitive data. Attackers with access to the affected workspaces can exploit the path traversal flaw to load harmful artifacts from local locations that should not be accessible.

This can lead to system compromise, data breaches, and potentially further exploitation within the affected environment.

Compliance Impact

The provided information does not explicitly address how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

Detection of this vulnerability involves identifying if your OpenClaw installation is a version before 2026.4.25 and if the affected feature related to memory-core artifact loading with local package root resolution is enabled.

Since the vulnerability is related to path traversal in memory-core artifact loading influenced by workspace state, you should check your workspace configurations and package root resolutions for any unexpected or unintended local paths being used.

There are no specific commands provided in the resources to detect exploitation or presence of this vulnerability on your system or network.

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade OpenClaw to version 2026.4.25 or later where the issue is patched.

  • Run memory-core flows only from trusted workspaces until the patch is applied.
  • Keep channel and tool allowlists narrow to limit exposure.
  • Avoid sharing Gateways between untrusted users.
  • Disable the affected feature related to local package root resolution if it is not necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53813. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart