Executive brief
OpenClaw is a user-controlled local AI assistant. A vulnerability in how shared reply media paths are validated allows a crafted malicious reply to be shared across channels, causing another channel to read and exfiltrate local files as if they were trusted generated media. An attacker with the ability to craft shared replies can access sensitive files on the system without proper authorization.
Technical details
The vulnerability is a path traversal and resource exposure issue (CWE-668, CWE-73) in OpenClaw's shared reply MEDIA handling. Shared reply MEDIA paths are treated as trusted without proper validation, allowing a crafted MEDIA reference to bypass security boundaries. An attacker can craft a malicious shared reply that causes another channel to load and exfiltrate local file paths as trusted generated media, crossing trust boundaries between channels. This is a local privilege/trust escalation within the OpenClaw trust model. The fix was applied in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 and is available in npm version 2026.4.8.
Affected products
- OpenClaw OpenClaw <=2026.4.4
Timeline
- 2026-04-09: disclosed
- 2026-04-08: patched: Fix applied to main branch; patched npm version 2026.4.8 released