Technical impact
OpenClaw versions prior to 2026.4.8 propagate trusted status to shared reply MEDIA paths without validating the referenced local file locations. An attacker can craft a malicious shared reply media reference that, when resolved by another channel in the same installation, causes that channel to read a local file path as though it were a legitimate media resource. This flaw does not provide code execution but allows the disclosure of arbitrary files that the process can read, compromising confidentiality and potentially leaking sensitive data.
Affected Systems
OpenClaw, versions earlier than 2026.4.8 running on node.js environments are impacted. The vulnerability surfaces in all deployments that make use of the shared reply media feature.
Risk and Exploitability
The CVSS score of 5.9 indicates moderate impact, and while no EPSS score is available, the flaw is not listed in CISA KEV, suggesting limited public exploitation. The likely attack vector involves an authenticated or authorized user who can send a crafted media reference in their own channel, leading an adjacent channel to exfiltrate a local file path. The exploitation requires that the receiving channel resolves the path without proper validation, so the attack works locally within the same instance and can leak internal data without privilege escalation.
Github GHSA