OpenClaw local file disclosure via MEDIA: path parsing
OpenClaw versions before 2026.2.1 could disclose local files when an agent emitted a MEDIA: token pointing to an arbitrary file path, potentially exposing files readable by the OpenClaw process. The vulnerability was patched to restrict inbound media staging to the OpenClaw media directory.
What happened
OpenClaw versions prior to 2026.2.1 could reference local file paths when parsing MEDIA: tokens, allowing OpenClaw to stage and send referenced files as attachments.
If an agent could be influenced to emit a MEDIA: token pointing at a local file, a remote user might obtain the contents of files readable by the OpenClaw process.
Reported impact
The vulnerability could enable local file disclosure of files readable by the OpenClaw process.
Index analysis
The source code in src/media/parse.ts was patched to restrict inbound media staging to the OpenClaw media directory, preventing arbitrary absolute paths from being accessed.
Governance controls
The vulnerability was reported by security researcher jasonsutter87 and addressed through a patch released in version 2026.2.1.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.