Openclaw cli: OpenClaw: Webchat audio embedding could read local files without local-root containment (CVE-2026-44996)

OpenClaw deployments prior to version 2026.4.15 lack a local media root containment check in the webchat audio embedding path. An attacker able to influence the ReplyPayload.mediaUrl can cause the system to resolve absolute local paths or file: URLs, read local audio-like files under a size cap, and embed their base64-encoded content into webchat media responses. This represents a security boundary failure allowing local file read via the webchat assistant/media transcript path. The fix introduced local media root checks and a trustedLocalMedia gate to prevent untrusted payloads from exploiting this.

The vulnerability allows reading of local audio files accessible to the gateway process and embedding their contents into webchat responses. This could expose sensitive local file contents through the webchat interface. However, the impact is limited by the need for the file to be audio-like, readable by the process, and within a size cap. It does not provide a general remote filesystem API or broader host access.

Upgrade to openclaw version 2026.4.15 or later, such as the latest public release 2026.4.21, which contains the fix. Before upgrading, avoid exposing webchat sessions to untrusted prompt or tool content that can influence reply media URLs. The fix enforces local media root containment and restricts untrusted payloads from opting into local audio embedding.