OpenClaw prior to version 2026.4.25 is affected by a path traversal flaw in the memory‑core artifact loading routine where the current workspace state is used to resolve the local package root. Attackers who have access to a vulnerable workspace can instruct the system to load artifacts from unintended local directories. This enables the execution of arbitrary code or the acquisition of sensitive data that resides on the host. The weakness maps to CWE‑427, a classic path traversal issue.

Any deployment of OpenClaw built with a version older than 2026.4.25, regardless of the runtime environment, is susceptible when the default workspace configuration is in use. The problem is present in all setups that rely on the memory‑core artifact loader for local package resolution.

The CVSS score of 7.3 denotes a high severity, indicating that exploitation can have serious consequences. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the lack of a KEV listing suggests that there is no current evidence of large‑scale use of this vulnerability. Exploitation requires the attacker to already possess workspace access, which could be achieved through authenticated compromise, social engineering, or other means of obtaining privileges in a shared environment. Once access is granted, the attacker can trigger arbitrary code execution or data exposure via the affected artifact loader.