Executive Summary

This vulnerability exists in OpenClaw versions before 2026.4.25 and involves a path traversal issue during the loading of memory-core artifacts. The problem arises because the workspace state affects how the local package root is resolved. As a result, attackers who have access to the affected workspaces can exploit this flaw to load memory-core artifacts from unintended local locations.

This can allow attackers to execute malicious code or access sensitive data by tricking the system into loading harmful or unauthorized files.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have serious impacts including unauthorized execution of malicious code and unauthorized access to sensitive data. Attackers with access to the affected workspaces can exploit the path traversal flaw to load harmful artifacts from local locations that should not be accessible.

This can lead to system compromise, data breaches, and potentially further exploitation within the affected environment.

Useful 0 Not Useful 0