CVE-2026-100526
Received Received - Intake

Path Traversal in OpenClaw Discord Integration

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same sender's configured media roots would otherwise reject, placing bytes from an out-of-policy local file into an outbound emoji or sticker upload. Exploitation requires access to the guild asset action and knowledge or derivation of a useful local path; the issue does not permit unrestricted filesystem browsing or code execution. The issue is fixed in @openclaw/discord 2026.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100526
EUVD
EUVD-2026-87524

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw discord to 2026.9.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenClaw's Discord integration (npm package @openclaw/discord before version 2026.9.3) allows a sender with guild asset action permissions to bypass media policy restrictions. It enables reading a local file path that should be rejected by media roots policy and includes its contents in an uploaded emoji or sticker. Exploitation requires access to guild asset actions and knowledge of a valid local path but does not allow unrestricted filesystem browsing or code execution.

Detection Guidance

Check installed versions of @openclaw/discord with npm list @openclaw/discord. If the version is below 2026.9.3, the system is vulnerable. Review Discord guild asset upload permissions for users with access to emoji or sticker actions.

Impact Analysis

This vulnerability could lead to unauthorized data exposure by allowing attackers to read and include contents of out-of-policy local files in emoji or sticker uploads. While it does not permit unrestricted filesystem access or code execution, it may expose sensitive data if media roots include directories with confidential files.

Compliance Impact

This vulnerability could lead to unauthorized data exposure by allowing attackers to read local files that should be restricted by media policy. For GDPR, this may violate principles of data minimization and security. For HIPAA, it could risk exposing protected health information if sensitive files are accessed.

Mitigation Strategies

Upgrade @openclaw/discord to version 2026.9.3 or later. Restrict guild asset upload permissions to only trusted users. Ensure media roots do not include directories with sensitive files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100526. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart