Executive brief
OpenClaw is an open-source platform that enables AI agents to interact with users via webchat interfaces. A vulnerability in versions 2026.4.7 through 2026.4.14 allows attackers to craft malicious tool-result media references that bypass file containment restrictions, potentially exposing sensitive files stored on the host system or triggering unauthorized Windows network access with cached credentials.
Technical details
The vulnerability is a path traversal / external control of file name issue (CWE-73, CWE-22) in OpenClaw's webchat media embedding logic. The root cause is that tool-result media path normalization fails to enforce the configured local-root containment policy before passing paths to the host-side media embedding component. An attacker can craft a tool-result media reference containing local file:// URLs or Windows UNC paths that bypass the intended directory restrictions. The attack vector is network-accessible (through a crafted tool result message), with no authentication or user interaction required at the technical level, though exploitation depends on a tool-result media reference reaching the webchat embedding path. An attacker can achieve arbitrary local file read or Windows network path access, potentially disclosing sensitive files or exposing cached credentials. The fix was released in OpenClaw version 2026.4.15, which hardens media path parsing, rejects remote file:// URLs and Windows network paths before filesystem access, and enforces local-root containment before stat or read operations.
Affected products
- OpenClaw OpenClaw 2026.4.7 before 2026.4.15
Timeline
- 2026-04-16: disclosed
- 2026-04-20: patched: Version 2026.4.15 released
- 2026-04-20: advisory