Every CVE Search/ Get API key

CVE-2026-41389

OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths

6.3 MediumFix available

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.26%Up 0.2 points since Apr 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

Record
CVE-2026-41389
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-73
Updated
2026-11-02
EUVDEUVD-2026-23931 6.3

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

Record
EUVD-2026-23931
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-mr34-9552-qr95 6.3

OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

Summary

Webchat tool-result media normalization could pass local and UNC-style file paths into the host-side media embedding path without applying the configured local-root containment policy.

Impact

A crafted tool-result media reference could cause the host to attempt local file reads or Windows UNC/network path access while preparing webchat media blocks. This could disclose allowed host files or trigger network credential exposure on affected Windows deployments. Severity remains medium because exploitation depends on a tool-result media path reaching the webchat embedding path, but the sink is a host-side file read before the user sees the rendered result.

Affected versions

  • Affected: >= 2026.4.7, < 2026.4.15
  • Patched: 2026.4.15

Fix

OpenClaw 2026.4.15 hardens the webchat media path and the shared media resolver. Remote-host file:// URLs and Windows network paths are rejected before filesystem access, and audio embedding now enforces configured localRoots containment before stat or read operations.

Verified in v2026.4.15:

  • src/gateway/server-methods/chat-webchat-media.ts uses safe file-URL parsing, rejects Windows network paths, and calls assertLocalMediaAllowed before probing local audio files.
  • src/media/web-media.ts rejects remote-host file:// URLs, Windows network paths, and local-root bypasses on the shared media path.
  • src/gateway/server-methods/chat-webchat-media.test.ts covers both remote-host file:// rejection and local-root denial before filesystem access.

Fix commits included in v2026.4.15 and absent from v2026.4.14:

  • 1470de5d3e0970856d86cd99336bb8ada3fe87da via PR #67293
  • 6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde via PR #67298
  • 52ef42302ead9e183e6c8810e0a04ee4ef8ae9fc via PR #67303 as defense-in-depth for trusted media passthrough anchoring

Thanks to @Kherrisan for reporting this issue.

Record
GHSA-mr34-9552-qr95
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-22, CWE-73
Updated
2026-11-02
GitHub AdvisoriesGHSA-qc5j-2mqx-x83q 6.3

Duplicate Advisory: OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mr34-9552-qr95. This link is maintained to preserve external references.

Original Description

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

Record
GHSA-qc5j-2mqx-x83q
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-73
Updated
2026-11-02
NVD 6.3

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

Record
CVE-2026-41389
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-73
Updated
2026-11-02
OSV 6.3

OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

Record
CVE-2026-41389
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Weakness
CWE-73
Updated
2026-11-11
OSVGHSA-mr34-9552-qr95 6.3

OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

Summary

Webchat tool-result media normalization could pass local and UNC-style file paths into the host-side media embedding path without applying the configured local-root containment policy.

Impact

A crafted tool-result media reference could cause the host to attempt local file reads or Windows UNC/network path access while preparing webchat media blocks. This could disclose allowed host files or trigger network credential exposure on affected Windows deployments. Severity remains medium because exploitation depends on a tool-result media path reaching the webchat embedding path, but the sink is a host-side file read before the user sees the rendered result.

Affected versions

  • Affected: >= 2026.4.7, < 2026.4.15
  • Patched: 2026.4.15

Fix

OpenClaw 2026.4.15 hardens the webchat media path and the shared media resolver. Remote-host file:// URLs and Windows network paths are rejected before filesystem access, and audio embedding now enforces configured localRoots containment before stat or read operations.

Verified in v2026.4.15:

  • src/gateway/server-methods/chat-webchat-media.ts uses safe file-URL parsing, rejects Windows network paths, and calls assertLocalMediaAllowed before probing local audio files.
  • src/media/web-media.ts rejects remote-host file:// URLs, Windows network paths, and local-root bypasses on the shared media path.
  • src/gateway/server-methods/chat-webchat-media.test.ts covers both remote-host file:// rejection and local-root denial before filesystem access.

Fix commits included in v2026.4.15 and absent from v2026.4.14:

  • 1470de5d3e0970856d86cd99336bb8ada3fe87da via PR #67293
  • 6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde via PR #67298
  • 52ef42302ead9e183e6c8810e0a04ee4ef8ae9fc via PR #67303 as defense-in-depth for trusted media passthrough anchoring

Thanks to @Kherrisan for reporting this issue.

Record
GHSA-mr34-9552-qr95
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-22, CWE-73
Updated
2026-11-02
OSVGHSA-qc5j-2mqx-x83q 6.3

Duplicate Advisory: OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mr34-9552-qr95. This link is maintained to preserve external references.

Original Description

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

Record
GHSA-qc5j-2mqx-x83q
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-73
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 2026.4.7 up to 2026.4.15
2026.4.15

History

History
RecordedChangedSources
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41389 is a medium vulnerability (CVSS 6.3) in Openclaw, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in openclaw 2026.4.15.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open