OpenClaw: Webchat media embedding enforces local-root containment for tool-result files
Summary
Webchat tool-result media normalization could pass local and UNC-style file paths into the host-side media embedding path without applying the configured local-root containment policy.
Impact
A crafted tool-result media reference could cause the host to attempt local file reads or Windows UNC/network path access while preparing webchat media blocks. This could disclose allowed host files or trigger network credential exposure on affected Windows deployments. Severity remains medium because exploitation depends on a tool-result media path reaching the webchat embedding path, but the sink is a host-side file read before the user sees the rendered result.
Affected versions
- Affected:
>= 2026.4.7, < 2026.4.15 - Patched:
2026.4.15
Fix
OpenClaw 2026.4.15 hardens the webchat media path and the shared media resolver. Remote-host file:// URLs and Windows network paths are rejected before filesystem access, and audio embedding now enforces configured localRoots containment before stat or read operations.
Verified in v2026.4.15:
src/gateway/server-methods/chat-webchat-media.tsuses safe file-URL parsing, rejects Windows network paths, and callsassertLocalMediaAllowedbefore probing local audio files.src/media/web-media.tsrejects remote-hostfile://URLs, Windows network paths, and local-root bypasses on the shared media path.src/gateway/server-methods/chat-webchat-media.test.tscovers both remote-hostfile://rejection and local-root denial before filesystem access.
Fix commits included in v2026.4.15 and absent from v2026.4.14:
1470de5d3e0970856d86cd99336bb8ada3fe87davia PR #672936e58f1f9f54bca1fea1268ec0ee4c01a2af03ddevia PR #6729852ef42302ead9e183e6c8810e0a04ee4ef8ae9fcvia PR #67303 as defense-in-depth for trusted media passthrough anchoring
Thanks to @Kherrisan for reporting this issue.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | >= 2026.4.7, < 2026.4.15 | 2026.4.15 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-mr34-9552-qr95
- https://nvd.nist.gov/vuln/detail/CVE-2026-41389
- https://github.com/openclaw/openclaw/pull/67293
- https://github.com/openclaw/openclaw/pull/67298
- https://github.com/openclaw/openclaw/pull/67303
- https://github.com/openclaw/openclaw/commit/1470de5d3e0970856d86cd99336bb8ada3fe87da
- https://github.com/openclaw/openclaw/commit/52ef42302ead9e183e6c8810e0a04ee4ef8ae9fc
- https://github.com/openclaw/openclaw/commit/6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-unvalidated-tool-result-media-paths
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N- Weakness (CWE)
CWE-22, CWE-73- Platform
- npm
- Package
openclaw- Disclosed
- 17.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mr34-9552-qr95 - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw: Webchat media embedding enforces local-root containment for tool-result files this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.