A flaw in the shouldSkipTargetPath function of the Static Scanner in OpenClaw ClawScan allows local manipulation of the protection mechanism, causing the scanner to skip or incorrectly evaluate target paths. The defect permits a local attacker to override the intended path filtering behaviour, potentially enabling traversal or exposures of previously restricted files. The CVE description states that the exploit has been publicly released and may be used for attacks.

OpenClaw ClawScan versions up to and including 0.1.6 are affected. The vulnerability resides in the internal/runner/runner.go component of the Static Scanner. Upgrading to version 0.1.7 or later resolves the issue.

The CVSS score of 4.8 indicates moderate severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the ClawScan process; there is no mention of a network‑based or remote attack vector. The publicly available exploit allows a local attacker who can interact with the program to bypass the skip logic, potentially enabling unauthorized file scanning or traversal within the local environment.