Executive brief
OpenClaw is an AI chat platform with media embedding capabilities. A vulnerability in the webchat media embedding feature could allow attackers to craft malicious tool-result references that cause the host system to read local files or access Windows network paths, potentially exposing sensitive files or triggering credential exposure on Windows deployments.
Technical details
The vulnerability is a path traversal (CWE-22) and external control of file paths (CWE-73) in OpenClaw's webchat media normalization logic. When processing tool-result media references, the code failed to enforce the configured local-root containment policy, allowing local file paths and Windows UNC-style paths to reach the host-side media embedding function. An attacker can craft a tool-result media reference that causes the host to attempt filesystem access to arbitrary local or network paths before the media is rendered to the user. The vulnerability was patched in version 2026.4.15 by adding validation to reject remote file:// URLs and Windows network paths before filesystem operations, and enforcing local-root containment checks before stat/read operations.
Affected products
- OpenClaw openclaw >= 2026.4.7, < 2026.4.15
Timeline
- 2026-04-17: disclosed
- 2026-04-15: patched: Version 2026.4.15