OpenClaw versions earlier than 2026.3.24 allow a remote attacker to read arbitrary local files by exploiting a sandbox bypass in the message tool. The vulnerability comes from mediaUrl and fileUrl alias parameters that bypass the localRoots validation, enabling the attacker to retrieve files outside the intended sandbox. This can lead to disclosure of sensitive data and compromise the underlying system.

Affected deployments include any installation of OpenClaw prior to 2026.3.24. The product is OpenClaw, developed by the OpenClaw team, and runs on a node.js environment.

The CVSS score is 7.1, indicating a medium to high risk if exploited. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is known at disclosure. The attack can be performed remotely by crafting requests that use the mediaUrl or fileUrl parameters, providing a clear path to information disclosure and potential privilege escalation depending on file permissions.