OpenClaw path traversal in webchat audio embedding

Executive brief

OpenClaw, an AI agent and webchat platform, contains a vulnerability where the system could be tricked into reading and exposing local files from the host server. By manipulating chat responses, an attacker could force the application to embed sensitive local files as audio data in the chat transcript. This could lead to the unauthorized disclosure of server-side information, though the impact is limited to small files with audio-like extensions.

Technical details

A path traversal and information disclosure vulnerability exists in OpenClaw's webchat audio embedding helper. The component failed to apply local-root containment checks when resolving media URLs, allowing the resolution of absolute local paths or 'file:' URLs. An attacker capable of influencing 'ReplyPayload.mediaUrl' (e.g., via prompt injection or malicious tool output) can cause the gateway process to read local files, base64-encode them, and return them in the chat transcript. Exploitation is limited to files readable by the gateway process that have audio-like extensions and fall under the webchat size cap. The issue is fixed in version 2026.4.15 by implementing 'assertLocalMediaAllowed' and a 'trustedLocalMedia' gate.

Affected products

• OpenClaw openclaw <= 2026.4.14

Timeline

• 2026-04-22: patched: Initial patch released in version 2026.4.15
• 2026-04-29: advisory: GitHub Advisory GHSA-gfg9-5357-hv4c published

References

• https://api.github.com/users/zsxsoft
• https://github.com/zsxsoft
• https://api.github.com/users/zsxsoft/gists%7B/gist_id%7D
• https://api.github.com/users/zsxsoft/repos
• https://avatars.githubusercontent.com/u/2398785?v=4
• https://api.github.com/users/zsxsoft/events%7B/privacy%7D