{"data":{"id":"f63fde7a-fa1a-431b-9a81-299041857c9d","title":"GHSA-56pc-6hvp-4gv4: OpenClaw vulnerable to arbitrary file read via $include directive","summary":"A path traversal flaw (CWE-22) in OpenClaw's config `$include` resolution lets anyone who can modify the config read arbitrary local files outside the config directory. Absolute paths, `../` traversal and symlinks inside the config directory all reach external files unless real-path checks are enforced. Exposure is bounded by the OpenClaw runtime user's file permissions, and the impact includes local API keys and private config material.","solution":"Fixed in 2026.2.17 (patched versions `>=2026.2.17`; affected versions `<=2026.2.15`). Fix commit: d1c00dbb7c64a39e205464dae7f2a068420e91c1.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-56pc-6hvp-4gv4","publishedAt":"2026-03-03T19:57:23.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.17 (fixed: 2026.2.17)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-56pc-6hvp-4gv4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-18T02:47:54.422Z","daysToFix":-13,"fixCheckedAt":"2026-10-29T21:40:19.141Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.17","matchedVersion":"2026.2.17","fixReleasedAt":"2026-02-18T02:47:54.422Z","daysToFix":-13,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:18.994Z"}]}}