OpenClaw versions prior to 2026.8.1 allow certain users to provide Unicode‑encoded filenames that the system normalises to a path outside the specified workspace. This path‑traversal flaw is a classic CWE‑22 condition, letting an attacker read any file the process can access on the host. The effect is the disclosure of confidential or configuration information that lies beyond the intended file boundaries.

All deployments of OpenClaw below version 2026.8.1 are affected. The vulnerability is present in the tools.fs.workspaceOnly feature and applies to any instance that exposes this capability to admitted requesters.

The CVSS score of 6 indicates moderate severity; EPSS is currently unavailable and the issue is not listed in CISA’s KEV catalog. Attackers who can send requests to the vulnerable feature can craft Unicode filenames that resolve to a parent directory, allowing them to read files outside the configured workspace. Because the flaw is limited to file references, it does not lead directly to code execution but can expose sensitive data and enable further attacks if additional information is gained.