The vulnerability resides in the tools.exec.safeBins function of the File Existence Handler component in OpenClaw. By manipulating the input, an attacker can cause the component to expose sensitive file existence information. This leads to information disclosure because an attacker may infer the presence or absence of protected files. The weakness is classified as CWE-200 and CWE-203, indicating an information exposure due to improper handling of file paths and discrepancy-based leakage.

OpenClaw applications running any version up to and including 2026.2.17 are affected. The vulnerability is present in all builds of OpenClaw that include the File Existence Handler component, regardless of the underlying operating system or Node.js runtime as indicated by the CPE entries.

The CVSS score is 4.8, reflecting a moderate severity. The EPSS score is less than 1%, meaning exploitation is expected to be rare. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, further reducing its public exploit likelihood. Exploitation requires local access to the system, so an attacker must already have some level of entry. Given the local scope and low exploit probability, the overall risk is low but not negligible for systems that handle confidential data.