CVE-2026-45224
published 2026-05-11CVE-2026-45224: Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or…
PriorityP434high7.1CVSS 3.1
AVLACLPRNUIRSUCNIHAH
EPSS
0.14%
4.0th percentile
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | openclaw_crabbox | >= 0 < 0.9.0 | 0.9.0 |
| openclaw | crabbox | < 0.9.0 | 0.9.0 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
nvdv4.06.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3cjv-h753-qf7h: Crabbox before 0
ghsa_unreviewed·2026-05-11
CVE-2026-45224 [MEDIUM] CWE-22 GHSA-3cjv-h753-qf7h: Crabbox before 0
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.
GHSA
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution
ghsa·2026-05-11
CVE-2026-45224 [MEDIUM] CWE-22 Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation.
VulDB
openclaw crabbox up to 0.8.x /workspace path traversal
vuldb·2026-05-11·CVSS 6.8
CVE-2026-45224 [MEDIUM] openclaw crabbox up to 0.8.x /workspace path traversal
A vulnerability classified as critical was found in openclaw crabbox up to 0.8.x. The impacted element is an unknown function of the file /workspace. The manipulation results in path traversal.
This vulnerability is cataloged as CVE-2026-45224. The attack must be initiated from a local position. There is no exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-11
Published