What is the CVSS score of CVE-2026-25475?

CVE-2026-25475 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of AI / ML are affected by CVE-2026-25475?

Organizations using OpenClaw should be aware of notable risk from CVE-2026-25475, a path traversal vulnerability rated CVSS 6.5. This could allow unauthorized file access.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25475?

Yes, a public proof-of-concept exploit is available for CVE-2026-25475. Prioritise patching immediately. EPSS: 0.1%.

AI / ML CVE-2026-25475

MEDIUM

Path Traversal (CWE-22)

2026-02-04 security-advisories@github.com

GHSA-r8g4-86fx-92mq

Path Traversal AI / ML Openclaw

6.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 13, 2026 - 14:42 vuln.today

Public exploit code

CVE Published

Feb 04, 2026 - 20:16 nvd

MEDIUM 6.5

DescriptionNVD

OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.

AnalysisAI

OpenClaw versions prior to 2026.1.30 suffer from a path traversal vulnerability in the isValidMedia() function that permits authenticated agents to read arbitrary files on the system by crafting malicious MEDIA output directives. An attacker with agent access can leverage this flaw to exfiltrate sensitive data accessible to the application process. …

RemediationAI

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-25475 vulnerability details – vuln.today

Back

AI / ML CVE-2026-25475

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code