CVE-2026-25475
Path Traversal in OpenClaw Media Parser Enables Arbitrary File Access
Publication date: 2026-02-04
Last updated on: 2026-02-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.1.30 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-25475 is a Local File Inclusion (LFI) vulnerability in the OpenClaw AI assistant's isValidMedia() function. This function is supposed to validate media file paths but incorrectly allows arbitrary file paths, including absolute paths, home directory paths, and directory traversal sequences."}, {'type': 'paragraph', 'content': 'Because of this flaw, an attacker can trick the system into reading and exposing any file accessible to the agent user by using specially crafted input like MEDIA:/etc/passwd or MEDIA:~/.ssh/id_rsa. This can lead to sensitive data such as SSH keys, cloud credentials, and critical system files being exposed.'}, {'type': 'paragraph', 'content': 'The vulnerability affects all OpenClaw versions up to 2026.1.29 and was fixed in version 2026.1.30.'}] [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with low privileges to read any file on the system that the OpenClaw agent user can access, without requiring user interaction.
The attacker can exfiltrate sensitive information such as private SSH keys, cloud service credentials, API keys, and critical system files, potentially leading to unauthorized access to other systems or services.
The confidentiality of your system is at high risk, although the vulnerability does not affect system integrity or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves the isValidMedia() function improperly allowing arbitrary file paths, which can be exploited by outputting strings like MEDIA:/etc/passwd or MEDIA:~/.ssh/id_rsa to read sensitive files.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your system or network, you can monitor logs or outputs for suspicious MEDIA: path patterns that include absolute paths (/), home directory paths (~), or directory traversal sequences (../).'}, {'type': 'paragraph', 'content': 'Suggested commands include searching application logs or output streams for these patterns. For example, using grep on log files or process outputs:'}, {'type': 'list_item', 'content': "grep -rE 'MEDIA:(/|~|\\.\\./)' /path/to/openclaw/logs"}, {'type': 'list_item', 'content': "grep -r 'MEDIA:' /path/to/openclaw/logs | grep -E '(/|~|\\.\\./)'"}, {'type': 'paragraph', 'content': 'Additionally, monitoring network traffic for data exfiltration patterns containing MEDIA: paths could help detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade OpenClaw to version 2026.1.30 or later, where the vulnerability in isValidMedia() has been patched.
If upgrading immediately is not possible, restrict access to the vulnerable OpenClaw agent to trusted users only, and monitor for suspicious MEDIA: path usage as a temporary measure.
Consider applying any available patches or pull requests (such as pull request #4930) that fix the validation logic if you maintain your own build.
Also, review and limit file system permissions for the OpenClaw agent user to minimize the impact of potential exploitation.