The vulnerability stems from the isValidMedia() function in src/media/parse.ts, which accepts arbitrary file paths, including absolute paths and directory traversal sequences. An agent issuing a MEDIA:/path/to/file request can read any file on the system, enabling exfiltration of sensitive data to the user or channel. This is a Local File Inclusion flaw that leads to information exposure (CWE-200) and path traversal (CWE-22).

OpenClaw personal AI assistant versions earlier than 2026.1.30. The affected product is listed under the vendor openclaw:openclaw. Users running any pre‑2026.1.30 release are vulnerable.

The CVSS score indicates a medium severity (6.5). EPSS is below 1 %, meaning the probability of exploitation at present is low, and the vulnerability is not present in the CISA KEV list. The attack requires an agent with local execution ability within OpenClaw to emit a MEDIA command; network exposure is not required. If the assistant runs with elevated system privileges, the scope of accessed files can be extensive, but the vulnerability remains limited to files readable by the process. Given the low exploit likelihood and the absence of a public exploit, the overall risk is moderate, yet the potential for data leakage warrants prompt remediation.