CVE-2026-94094

Received Received - Intake

Path Traversal in OpenClaw Canvas Extension

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-20

Last Modified

2026-09-20

Generated

2026-09-21

AI Q&A

2026-09-21

EPSS Evaluated

N/A

NVD

CVE-2026-94094

EUVD

EUVD-2026-83801

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.9.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service flaw in OpenClaw versions up to 2026.9.5. It exists in the createCanvasHostHandler function of the Canvas Host Route component. The issue allows remote attackers to cause a denial of service by manipulating input, as the application buffers entire files without size limits unlike other paths which cap at 64KB.

Detection Guidance

This vulnerability involves a denial of service in OpenClaw due to unbounded file buffering. To detect it, monitor for unusually high memory usage or processes holding large files in memory. Check OpenClaw logs for requests to the canvas host route that process large files. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to disrupt service availability by consuming excessive server resources. If exploited, it may cause the OpenClaw application to become unresponsive or crash, leading to downtime for users relying on the service.

Compliance Impact

This vulnerability causes a denial of service via remote attack due to improper file handling in OpenClaw. While it does not directly expose sensitive data, a denial of service could impact system availability, which may affect compliance with regulations requiring reliable access to systems handling personal or health data under GDPR or HIPAA.

Mitigation Strategies

Upgrade OpenClaw to a version beyond 2026.9.5 where the fix for streaming/size-limit has been properly implemented to prevent whole file buffering.

Hi! I’m here to help you understand CVE-2026-94094. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70