[openclaw] OpenClaw Canvas Path Traversal Information Disclosure Vulnerability

**[openclaw] OpenClaw Canvas Path Traversal Information Disclosure Vulnerability**

ZDI-CAN-29312: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: OpenClaw - OpenClaw -- VULNERABILITY DETAILS ------------------------ Version tested: openclaw 2026.2.17 Platform tested: macOS 26.3 Analysis Description The OpenClaw gateway's canvas tool accepts an a2ui_push action with a jsonlPath parameter that specifies a filesystem path to read. The gateway reads this file using fs.readFile() with no path validation, canonicalization, or directory restriction. An authenticated attacker can supply an arbitrary absolute or relative path to read any file accessible to the gateway process. The file contents are forwarded to the connected node client via the canvas.a2ui.pushJSONL WebSocket command. The gateway itself returns { ok: true } to the HTTP caller, confirming the file was read and transmitted...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.