OpenClaw versions prior to 2026.4.10 allow an attacker to read any file on the host that lies outside the intended media storage directory. The flaw stems from insecure handling of QQBot media tags in reply text, where a crafted tag can reference host‑local file paths, causing the server to retrieve and disclose the file contents. This can expose sensitive configuration files, credentials, or other confidential data stored on the system, potentially compromising confidentiality and integrity. The core weakness is a classic path traversal flaw, categorized as CWE‑23.

The vulnerability impacts installations of the OpenClaw application with versions older than 2026.4.10. All affected deployments that enable QQBot media tags are susceptible, regardless of the underlying operating system, as the flaw resides in application code.

The CVSS score of 8.9 classifies the issue as high severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, there is currently no evidence of widespread exploitation. The likely attack vector is remote message injection, where an attacker sends a malicious QQBot media tag from another user or external source. If the server processes replies from any authenticated or unauthenticated channel, the vulnerability can be triggered without local privileges and does not require additional exploitation conditions beyond the ability to send a message containing the crafted tag.