Openclaw cli: OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22) (CVE-2026-35668)

A path traversal vulnerability (CVE-2026-35668) in OpenClaw CLI's sandbox enforcement allows sandboxed agents to escape their sandbox by exploiting unnormalized `mediaUrl` and `fileUrl` parameter keys. The function `normalizeSandboxMediaParams` only validates a limited set of keys (`media`, `path`, `filePath`), excluding `mediaUrl` and `fileUrl` which are used by multiple channel extensions. Additionally, the `handlePluginAction` function drops the `mediaLocalRoots` context, causing plugins to fall back to default media roots that include all agents' workspaces. This combination enables an agent to read arbitrary files outside its sandbox, demonstrated by a proof-of-concept exploit reading secret files from another agent's workspace. The issue is fixed in OpenClaw version 2026.3.24.

An attacker controlling a sandboxed agent can read arbitrary files from other agents' workspaces by exploiting unvalidated parameters and missing sandbox root context. This leads to confidentiality breaches of sensitive files across agent sandboxes. The vulnerability does not affect integrity or availability but allows unauthorized data disclosure.

This vulnerability is fixed in OpenClaw CLI version 2026.3.24. Users should upgrade to this version or later to remediate the issue. No additional mitigation is required as the patch fully addresses the sandbox bypass.