A vulnerability in OpenClaw's memory-wiki ingest feature allows a Gateway caller with operator.write scope to read arbitrary local files instead of being restricted to intended ingest sources. This issue affects versions prior to 2026.5.12. The vulnerability does not alter the trusted-operator security model but can lead to unauthorized local file content being imported into wiki memory if the feature is enabled and accessible. The severity is assessed as medium based on the potential confidentiality impact without integrity or availability effects.