OpenClaw versions prior to 2026.2.24 suffer a local media root bypass in the sendAttachment and setGroupIcon message actions when the sandboxRoot is unset. The flaw allows an attacker to hydrate media from local absolute paths, enabling an arbitrary host file read of any file accessible to the runtime user. This vulnerability is a CWE‑22 (Absolute Path Traversal) and results in a confidentiality breach, as unauthorized data could be disclosed from the host file system.

The affected system is the OpenClaw messaging application distributed under the OpenClaw:OpenClaw product line. All releases before 2026.2.24 are impacted. The Common Platform Enumeration for the affected product is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw arises only when sandboxRoot is unset, the likely attack vector is local; an attacker with access to the running application can perform a file read of any system file within the runtime user's permissions. In environments where the application runs with elevated privileges, the risk of broader compromise increases. The absence of a publicly known workaround underscores the importance of applying the patch promptly.