Technical impact
The vulnerability is a Local File Inclusion flaw in the BlueBubbles media handling component of OpenClaw. By sending crafted requests to the sendBlueBubblesMedia endpoint, an attacker can supply a mediaPath value that bypasses the lack of validation and points to arbitrary files on the server filesystem. This allows reading sensitive files such as /etc/passwd and exfiltrating them as media attachments. The weakness corresponds to CWE‑73 results in confidentiality exposure.
Affected Systems
OpenClaw products prior to version 2026.2.14 are affected. The flaw exists only when the BlueBubbles extension is installed and enabled; no other OpenClaw components are impacted. Users running these older versions should verify whether the BlueBubbles feature is in use and apply the latest release otherwise.
Risk and Exploitability
The CVSS score of 8.2 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% indicates that, at present, exploitation is unlikely to be widespread, but the concept of a local file inclusion remains a serious risk. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to target the sendBlueBubblesMedia endpoint, either locally or via a remote attack vector, and to supply a malicious mediaPath parameter. This is inferred from the description and is not directly stated in the advisory.
Github GHSA