Openclaw cli: OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction (CVE-2026-25475)

The isValidMedia() function in src/media/parse.ts of openclaw-cli improperly validates media file paths by allowing absolute paths, home directory paths, and directory traversal sequences without restricting access to safe directories or verifying file types. This enables an agent to read any file accessible to the user running the agent by outputting MEDIA:/path/to/file, including sensitive files like ~/.ssh/id_rsa and /etc/passwd. The vulnerability is tracked as CVE-2026-25475 and affects versions >=2026.1.29 and <2026.1.30. A pull request containing a fix exists but has not been merged, so production deployments remain vulnerable.

An attacker with agent access can read and exfiltrate any file accessible to the agent user, including critical sensitive files such as SSH private keys, cloud credentials, API keys, and system files. This can lead to credential theft and unauthorized access to other systems or services. The vulnerability does not allow modification or denial of service but poses a significant confidentiality risk.

A patch addressing this vulnerability is available in a pull request but has not yet been merged into the main codebase. Until the fix is merged and deployed, systems remain vulnerable. Users should monitor the vendor repository for the official fix and apply it promptly once released. No vendor advisory states that no action is required or that the issue is mitigated, so applying the official fix when available is recommended.