OpenClaw CVE-2026-41366

Exploitation requires an authenticated user or model with access to invoke the appendLocalMediaParentRoots function. The vulnerability is triggered when this function processes directory paths without proper validation of parent directory references, allowing path traversal payloads to escape the media root directory. Default OpenClaw installations that expose the model inference API over the network and accept untrusted model-generated file paths are vulnerable. The exploit does NOT require local system access or elevated privileges on the host, only valid credentials for the OpenClaw service. However, exploitation is limited by the file permissions of the OpenClaw process - files readable only by other users or processes cannot be accessed.

CVSS 6.0 with AV:N/AC:L/PR:L vector indicates network-accessible exploitation requiring low complexity and prior user authentication. However, the description explicitly states 'model-initiated arbitrary host file read,' suggesting the vulnerability originates from a compromised or adversarially-controlled model rather than direct attacker input, which may limit real-world exploitation scope despite the network vector. EPSS score and KEV status are not provided, so exploitation probability cannot be independently assessed. The AV:N rating appears inconsistent with a 'local roots self-whitelisting' vulnerability - this suggests either the vulnerability can be triggered remotely through the model interface or the CVSS vector may require vendor clarification. The impact is limited to information disclosure (VC:H for confidentiality) with no integrity or availability impact. Real-world risk depends on whether the model is under attacker control and what sensitive files are accessible to the OpenClaw process. If OpenClaw runs with elevated privileges or can access system credentials, risk is elevated; if confined to user-writable directories, risk is lower.

An attacker with valid OpenClaw credentials (or compromised credentials) crafts a model inference request that triggers the vulnerable appendLocalMediaParentRoots function with malicious directory path traversal sequences (e.g., '../../../etc/passwd'). The insufficient validation allows the model or application layer to add parent directories outside the intended media sandbox to the whitelist, enabling subsequent file read operations to exfiltrate sensitive files such as system configuration, private keys, or application credentials. If the attacker operates the model directly, they can systematically enumerate and extract all files accessible to the OpenClaw process.