CVE-2026-25475

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25475", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T16:31:35.820Z", "datePublished": "2026-02-04T19:55:36.228Z", "dateUpdated": "2026-02-05T14:32:36.477Z"}, "containers": {"cna": {"title": "OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq"}], "affected": [{"vendor": "openclaw", "product": "openclaw", "versions": [{"version": "< 2026.1.30", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:55:36.228Z"}, "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30."}], "source": {"advisory": "GHSA-r8g4-86fx-92mq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:20:14.854756Z", "id": "CVE-2026-25475", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:32:36.477Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25475", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T14:20:14.854756Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:20:15.536Z"}}], "cna": {"title": "OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction", "source": {"advisory": "GHSA-r8g4-86fx-92mq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openclaw", "product": "openclaw", "versions": [{"status": "affected", "version": "< 2026.1.30"}]}], "references": [{"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq", "name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:55:36.228Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25475", "state": "PUBLISHED", "dateUpdated": "2026-02-05T14:32:36.477Z", "dateReserved": "2026-02-02T16:31:35.820Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T19:55:36.228Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openclaw", "vendor": "openclaw", "versions": [{"status": "affected", "version": "< 2026.1.30"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "85BCA27F-CEA4-4F4E-940F-5957B8EB247F", "versionEndExcluding": "2026.1.30", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30."}, {"lang": "es", "value": "OpenClaw es un asistente de IA personal. Antes de la versi\u00f3n 2026.1.30, la funci\u00f3n isValidMedia() en src/media/parse.ts permite rutas de archivo arbitrarias, incluyendo rutas absolutas, rutas de directorio de inicio y secuencias de salto de directorio. Un agente puede leer cualquier archivo en el sistema al generar MEDIA:/path/to/file, exfiltrando datos sensibles al usuario/canal. Este problema ha sido parcheado en la versi\u00f3n 2026.1.30."}], "id": "CVE-2026-25475", "lastModified": "2026-06-17T10:24:41.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25475", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:20:14.854756Z", "version": "2.0.3"}}]}, "published": "2026-02-04T20:16:07.287", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:18:07.928695+00:00", "value": {"mitigation_remediation": ["Update OpenClaw to version 2026.1.30 or later to apply the fix", "If an update cannot be performed immediately, disable or restrict the MEDIA command so that agents cannot request arbitrary file paths", "Verify that isValidMedia() now rejects unsupported path types by testing with known non\u2011allowed paths"], "summary": {"action": "Immediate Patch", "impact": "Local File Inclusion allowing arbitrary file read and data exfiltration"}, "threat_synthesis": {"affected_systems": "OpenClaw personal AI assistant versions earlier than 2026.1.30. The affected product is listed under the vendor openclaw:openclaw. Users running any pre\u20112026.1.30 release are vulnerable.", "description_and_impact": "The vulnerability stems from the isValidMedia() function in src/media/parse.ts, which accepts arbitrary file paths, including absolute paths and directory traversal sequences. An agent issuing a MEDIA:/path/to/file request can read any file on the system, enabling exfiltration of sensitive data to the user or channel. This is a Local File Inclusion flaw that leads to information exposure (CWE-200) and path traversal (CWE-22).", "risk_and_exploitability": "The CVSS score indicates a medium severity (6.5). EPSS is below 1\u202f%, meaning the probability of exploitation at present is low, and the vulnerability is not present in the CISA KEV list. The attack requires an agent with local execution ability within OpenClaw to emit a MEDIA command; network exposure is not required. If the assistant runs with elevated system privileges, the scope of accessed files can be extensive, but the vulnerability remains limited to files readable by the process. Given the low exploit likelihood and the absence of a public exploit, the overall risk is moderate, yet the potential for data leakage warrants prompt remediation."}}}}, "created": "2026-02-05T11:40:00.431135+00:00", "updated": "2026-04-17T23:30:15.904586+00:00", "vendors": ["openclaw", "openclaw$PRODUCT$openclaw"]}