The vulnerability allows authenticated attackers to read sensitive files on the server by manipulating path parameters to the canvas gateway endpoint. Because the system lacks proper validation of user‑supplied paths, it is possible to traverse directories and access files accessible to the service account. The primary impact is the disclosure of confidential information, such as configuration files or credentials, rather than execution of arbitrary code or denial of service.

OpenClaw installations are affected; no specific product versions are listed, so all deployed releases of OpenClaw may be vulnerable unless patched.

The CVSS score is 6.5, indicating medium severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from the data. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid authentication, so an attacker must first gain legitimate access or credential compromise. Once authenticated, path traversal can be used to retrieve sensitive files, presenting a moderate overall risk.