CVE-2026-35668

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots.

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots.

Fixed in OpenClaw 2026.3.24, the current shipping release.

Advisory Details

Title: Sandbox Media Root Bypass via Unnormalized mediaUrl / fileUrl Parameter Keys (CWE-22)

Description:

Summary

A path traversal vulnerability in the agent sandbox enforcement allows a sandboxed agent to read arbitrary files from other agents' workspaces by using the mediaUrl or fileUrl parameter key in message tool calls. The normalizeSandboxMediaParams function only checks ["media", "path", "filePath"] keys, while mediaUrl and fileUrl escape normalization entirely. Combined with handlePluginAction dropping mediaLocalRoots from the dispatch context, this enables a full sandbox escape where any agent can read files outside its designated sandbox root.

Details

The vulnerability exists in two files within the messaging pipeline:

1. Incomplete parameter key coverage in normalizeSandboxMediaParams:

In src/infra/outbound/message-action-params.ts, the function iterates over a hardcoded allowlist of parameter keys to validate:

// Line 212
const mediaKeys: Array<"media" | "path" | "filePath"> = ["media", "path", "filePath"];

The mediaUrl and fileUrl parameter keys are not included in this array. These keys are actively used by multiple channel extensions (Discord, Telegram, Slack, Matrix, Twitch) for media attachment handling, but they completely bypass the sandbox path validation performed by resolveSandboxedMediaSource.

2. Dropped mediaLocalRoots in handlePluginAction:

In src/infra/outbound/message-action-runner.ts, the handlePluginAction function dispatches actions to channel plugins but omits mediaLocalRoots from the context:

// Lines 684-697
const handled = await dispatchChannelMessageAction({
    channel,
    action,
    cfg,
    params,
    accountId: accountId ?? undefined,
    requesterSenderId: input.requesterSenderId ?? undefined,
    sessionKey: input.sessionKey,
    sessionId: input.sessionId,
    agentId,
    gateway,
    toolContext: input.toolContext,
    dryRun,
    // mediaLocalRoots is MISSING here
});

Despite ChannelMessageActionContext defining mediaLocalRoots?: readonly string[] (in src/channels/plugins/types.core.ts line 478), plugins receive undefined and fall back to getDefaultMediaLocalRoots(), which permits reads of the entire ~/.openclaw/ directory tree — including all agents' workspaces.

Attack chain:

1. A sandboxed agent (Agent-A at ~/.openclaw/workspace/agent-a/) calls the message tool with { mediaUrl: "~/.openclaw/workspace/agent-b/secret.txt" }
2. normalizeSandboxMediaParams skips the mediaUrl key (not in allowlist)
3. handlePluginAction dispatches without mediaLocalRoots
4. Plugin calls loadWebMedia with default roots, which allows ~/.openclaw/workspace/**
5. Agent-B's secret file content is read and sent as a channel attachment

PoC

Prerequisites:

• Docker installed
• OpenClaw Docker image built (openclaw-gateway:latest)

Steps:

1. Start the vulnerable gateway container:

cd llm-enhance/cve-finding/Path_Traversal/CVE-2026-27522-Media_Root_Bypass-variant-exp/
docker compose up -d
sleep 5

2. Run the exploit:

python3 poc_exploit.py

3. The exploit writes a secret file to ~/.openclaw/workspace/agent-b/secret_key.txt inside the container, then invokes normalizeSandboxMediaParams with Agent-A's sandbox policy and { mediaUrl: <agent-b-secret-path> }. The mediaUrl key bypasses normalization, and loadWebMedia reads the file successfully.

4. Run the control experiment to confirm sandbox works for checked keys:

python3 control-sandbox_enforced.py

Log of Evidence

Exploit output:

=== CVE-2026-27522 Variant: Sandbox Media Root Bypass ===

[*] Container 'openclaw-media-bypass-test' is running
[*] Running exploit script with Bun...

[VULNERABLE] mediaUrl bypassed normalizeSandboxMediaParams!
  Agent-A…

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots.

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots.

Fixed in OpenClaw 2026.3.24, the current shipping release.

Advisory Details

Title: Sandbox Media Root Bypass via Unnormalized mediaUrl / fileUrl Parameter Keys (CWE-22)

Description:

Summary

A path traversal vulnerability in the agent sandbox enforcement allows a sandboxed agent to read arbitrary files from other agents' workspaces by using the mediaUrl or fileUrl parameter key in message tool calls. The normalizeSandboxMediaParams function only checks ["media", "path", "filePath"] keys, while mediaUrl and fileUrl escape normalization entirely. Combined with handlePluginAction dropping mediaLocalRoots from the dispatch context, this enables a full sandbox escape where any agent can read files outside its designated sandbox root.

Details

The vulnerability exists in two files within the messaging pipeline:

1. Incomplete parameter key coverage in normalizeSandboxMediaParams:

In src/infra/outbound/message-action-params.ts, the function iterates over a hardcoded allowlist of parameter keys to validate:

// Line 212
const mediaKeys: Array<"media" | "path" | "filePath"> = ["media", "path", "filePath"];

The mediaUrl and fileUrl parameter keys are not included in this array. These keys are actively used by multiple channel extensions (Discord, Telegram, Slack, Matrix, Twitch) for media attachment handling, but they completely bypass the sandbox path validation performed by resolveSandboxedMediaSource.

2. Dropped mediaLocalRoots in handlePluginAction:

In src/infra/outbound/message-action-runner.ts, the handlePluginAction function dispatches actions to channel plugins but omits mediaLocalRoots from the context:

// Lines 684-697
const handled = await dispatchChannelMessageAction({
    channel,
    action,
    cfg,
    params,
    accountId: accountId ?? undefined,
    requesterSenderId: input.requesterSenderId ?? undefined,
    sessionKey: input.sessionKey,
    sessionId: input.sessionId,
    agentId,
    gateway,
    toolContext: input.toolContext,
    dryRun,
    // mediaLocalRoots is MISSING here
});

Despite ChannelMessageActionContext defining mediaLocalRoots?: readonly string[] (in src/channels/plugins/types.core.ts line 478), plugins receive undefined and fall back to getDefaultMediaLocalRoots(), which permits reads of the entire ~/.openclaw/ directory tree — including all agents' workspaces.

Attack chain:

1. A sandboxed agent (Agent-A at ~/.openclaw/workspace/agent-a/) calls the message tool with { mediaUrl: "~/.openclaw/workspace/agent-b/secret.txt" }
2. normalizeSandboxMediaParams skips the mediaUrl key (not in allowlist)
3. handlePluginAction dispatches without mediaLocalRoots
4. Plugin calls loadWebMedia with default roots, which allows ~/.openclaw/workspace/**
5. Agent-B's secret file content is read and sent as a channel attachment

PoC

Prerequisites:

• Docker installed
• OpenClaw Docker image built (openclaw-gateway:latest)

Steps:

1. Start the vulnerable gateway container:

cd llm-enhance/cve-finding/Path_Traversal/CVE-2026-27522-Media_Root_Bypass-variant-exp/
docker compose up -d
sleep 5

2. Run the exploit:

python3 poc_exploit.py

3. The exploit writes a secret file to ~/.openclaw/workspace/agent-b/secret_key.txt inside the container, then invokes normalizeSandboxMediaParams with Agent-A's sandbox policy and { mediaUrl: <agent-b-secret-path> }. The mediaUrl key bypasses normalization, and loadWebMedia reads the file successfully.

4. Run the control experiment to confirm sandbox works for checked keys:

python3 control-sandbox_enforced.py

Log of Evidence

Exploit output:

=== CVE-2026-27522 Variant: Sandbox Media Root Bypass ===

[*] Container 'openclaw-media-bypass-test' is running
[*] Running exploit script with Bun...

[VULNERABLE] mediaUrl bypassed normalizeSandboxMediaParams!
  Agent-A…