OpenClaw versions prior to 2026.3.28 contain a path traversal vulnerability in media parsing functions that allows attackers to bypass path validation and read arbitrary files outside the application sandbox. This can lead to disclosure of sensitive files such as system files, environment files, and SSH keys. The vulnerability is fixed in version 2026.3.28.