CVE-2026-25475: OpenClaw Path Traversal Vulnerability

CVE-2026-25475 Overview

CVE-2026-25475 is a Path Traversal vulnerability affecting OpenClaw, a personal AI assistant application. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts fails to properly validate file paths, allowing arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. This vulnerability enables an agent to read any file on the system by outputting MEDIA:/path/to/file, potentially exfiltrating sensitive data to the user or communication channel.

Critical Impact

Attackers can exploit this path traversal flaw to read sensitive files anywhere on the system, leading to information disclosure of credentials, configuration files, and other confidential data.

Affected Products

• OpenClaw versions prior to 2026.1.30

Discovery Timeline

• 2026-02-04 - CVE-2026-25475 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25475

Vulnerability Analysis

This vulnerability is classified under CWE-22 (Path Traversal), which occurs when software uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize sequences that can resolve to a location outside of that directory.

The flaw resides in the isValidMedia() function within src/media/parse.ts. This function is responsible for validating media file paths before processing them. However, the implementation does not adequately sanitize user-controlled input, allowing malicious actors to specify arbitrary file system locations.

The vulnerability can be exploited through the network with low attack complexity, requiring only low-level privileges. No user interaction is necessary to exploit this flaw. While the confidentiality impact is high, there is no direct impact on system integrity or availability.

Root Cause

The root cause of this vulnerability stems from insufficient input validation in the media path parsing logic. The isValidMedia() function accepts file paths without properly restricting them to intended directories. It fails to block:

• Absolute file paths (e.g., /etc/passwd)
• Home directory references (e.g., ~/sensitive_file)
• Directory traversal sequences (e.g., ../../../etc/shadow)

This allows an AI agent to construct a MEDIA: URI pointing to any file on the system, bypassing intended access restrictions.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker with basic privileges can exploit this flaw by manipulating the AI agent to output specially crafted MEDIA: URIs. The attack flow works as follows:

1. The attacker interacts with an OpenClaw instance, either directly or through a compromised context
2. The attacker crafts input that causes the AI agent to generate a MEDIA: output with a path traversal payload
3. The isValidMedia() function fails to reject the malicious path
4. The application reads and returns the contents of the targeted file
5. Sensitive data is exfiltrated to the attacker via the user/channel interface

Example malicious payloads could include references such as MEDIA:/etc/passwd, MEDIA:../../../etc/shadow, or MEDIA:~/.ssh/id_rsa. The vulnerability allows reading of any file accessible to the OpenClaw process user.

Detection Methods for CVE-2026-25475

Indicators of Compromise

• Unusual file access patterns in OpenClaw logs showing requests for sensitive system files
• MEDIA: URIs containing directory traversal sequences (../) or absolute paths in application logs
• AI agent outputs referencing system configuration files, credentials, or SSH keys
• Unexpected data exfiltration alerts from network monitoring systems

Detection Strategies

• Monitor OpenClaw application logs for MEDIA: requests containing path traversal patterns such as ../, absolute paths starting with /, or home directory references (~)
• Implement file integrity monitoring on sensitive system files to detect unauthorized read access
• Deploy endpoint detection rules to alert on suspicious file access by the OpenClaw process
• Review network traffic for potential data exfiltration following OpenClaw interactions

Monitoring Recommendations

• Enable verbose logging in OpenClaw to capture all media path requests and their resolution
• Configure SIEM rules to correlate file access events with OpenClaw process activity
• Monitor for anomalous user behavior patterns that may indicate exploitation attempts
• Implement real-time alerting for any access to sensitive directories by the OpenClaw application

How to Mitigate CVE-2026-25475

Immediate Actions Required

• Upgrade OpenClaw to version 2026.1.30 or later immediately
• Review application logs for any signs of exploitation prior to patching
• Audit the permissions of the user account running OpenClaw to minimize file system access
• Consider temporarily disabling the media functionality if immediate patching is not possible

Patch Information

OpenClaw has addressed this vulnerability in version 2026.1.30. The patch implements proper path validation in the isValidMedia() function to reject directory traversal sequences, absolute paths, and home directory references. Organizations should update to this version as soon as possible to remediate the risk.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Restrict the OpenClaw process to run with minimal file system permissions using OS-level access controls
• Implement a web application firewall or input filter to block requests containing path traversal patterns
• Run OpenClaw in a containerized environment with limited file system mounts to reduce exposure
• Apply strict filesystem sandboxing using technologies like AppArmor or SELinux to confine file access

# Example: Running OpenClaw in a restricted container with limited mounts
docker run --read-only \
  --tmpfs /tmp \
  -v /app/allowed-media:/media:ro \
  --security-opt=no-new-privileges \
  openclaw:2026.1.30