{"id":"CVE-2026-25475","aliases":["EUVD-2026-5363","GHSA-r8g4-86fx-92mq"],"status":"published","title":"OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction","description":"OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00827,"percentile":0.57952,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-22"],"published":"2026-02-04T19:02:51Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.1.30"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2026.1.29"},{"fixed":"2026.1.30"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.1.30"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25475","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r8g4-86fx-92mq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25475.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25475","title":"OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction","description":"OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.","status":"published","published":"2026-02-04T19:55:36.228Z","modified":"2026-02-05T14:32:36.477Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-5363","description":"OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.","status":"published","published":"2026-02-04T19:55:36Z","modified":"2026-02-05T14:32:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:43.720683Z"}],"ghsa":[{"id":"GHSA-r8g4-86fx-92mq","title":"OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction","description":"### Summary\nThe `isValidMedia()` function in `src/media/parse.ts` allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting `MEDIA:/path/to/file`, exfiltrating sensitive data to the user/channel.\n\n### Details\n**Location:** `src/media/parse.ts:17-27`\n\nThe path validation accepts dangerous patterns:\n\n```typescript\nfunction isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) {\n  if (candidate.startsWith(\"/\")) return true;      // ALLOWS /etc/passwd\n  if (candidate.startsWith(\"./\")) return true;\n  if (candidate.startsWith(\"../\")) return true;    // ALLOWS ../../etc/passwd\n  if (candidate.startsWith(\"~\")) return true;      // ALLOWS ~/secrets\n  return false;\n}\n```\n\nNo validation ensures the path is within a safe directory or is actually a media file.\n\n### PoC\n\nAgent outputs any of:\n```\nMEDIA:/etc/passwd\nMEDIA:~/.ssh/id_rsa\nMEDIA:~/.aws/credentials\nMEDIA:../../../etc/passwd\n```\n\nThe file contents are rendered/sent to the requesting user or channel.\n\n### Impact\n- Read ANY file accessible to the agent user\n- Exfiltrate SSH keys (`~/.ssh/id_rsa`)\n- Steal cloud credentials (`~/.aws/credentials`)\n- Access API keys (`.env`, `config.json`)\n- Read system files (`/etc/passwd`, `/etc/shadow`)\n\n**Note:** PR #4930 contains a fix but is NOT MERGED - production is vulnerable.","status":"published","published":"2026-02-04T19:02:51Z","modified":"2026-02-04T21:57:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2026-25475","description":"OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.","status":"published","published":"2026-02-04T20:16:07.287Z","modified":"2026-06-17T10:24:41.873Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:12:05.149641Z"}],"osv":[{"id":"CVE-2026-25475","title":"OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction","description":"OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.","status":"published","published":"2026-02-04T19:55:36.228Z","modified":"2026-10-28T02:30:33.698539848Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-r8g4-86fx-92mq","title":"OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction","description":"### Summary\nThe `isValidMedia()` function in `src/media/parse.ts` allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting `MEDIA:/path/to/file`, exfiltrating sensitive data to the user/channel.\n\n### Details\n**Location:** `src/media/parse.ts:17-27`\n\nThe path validation accepts dangerous patterns:\n\n```typescript\nfunction isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) {\n  if (candidate.startsWith(\"/\")) return true;      // ALLOWS /etc/passwd\n  if (candidate.startsWith(\"./\")) return true;\n  if (candidate.startsWith(\"../\")) return true;    // ALLOWS ../../etc/passwd\n  if (candidate.startsWith(\"~\")) return true;      // ALLOWS ~/secrets\n  return false;\n}\n```\n\nNo validation ensures the path is within a safe directory or is actually a media file.\n\n### PoC\n\nAgent outputs any of:\n```\nMEDIA:/etc/passwd\nMEDIA:~/.ssh/id_rsa\nMEDIA:~/.aws/credentials\nMEDIA:../../../etc/passwd\n```\n\nThe file contents are rendered/sent to the requesting user or channel.\n\n### Impact\n- Read ANY file accessible to the agent user\n- Exfiltrate SSH keys (`~/.ssh/id_rsa`)\n- Steal cloud credentials (`~/.aws/credentials`)\n- Access API keys (`.env`, `config.json`)\n- Read system files (`/etc/passwd`, `/etc/shadow`)\n\n**Note:** PR #4930 contains a fix but is NOT MERGED - production is vulnerable.","status":"published","published":"2026-02-04T19:02:51Z","modified":"2026-02-04T21:57:03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}