The vulnerability is a path traversal flaw in the Windows media loaders of OpenClaw. It accepts remote-host file URLs and UNC-style paths before validating them as local paths, allowing an attacker to supply a network-hosted file that the loader treats as local content. This can enable unauthorized access to files or potentially execution of local resources depending on how the application handles the retrieved media.

All instances of OpenClaw version earlier than 2026.3.22 that run on Windows and use the media loader component that processes external media URLs are affected.

The CVSS score of 6.9 signals moderate severity. Detailed exploitation probability metrics are not publicly available, and the vulnerability is not listed in the CISA known exploited vulnerabilities catalog. The attack requires the ability to supply a remote-host file URL or UNC path that the application will load; an attacker could host a malicious file on a network share or external HTTP server and point the application to that URL. If the application treats the data as local content, the attacker may gain unauthorized file access or compromise application integrity.