CVE-2026-25475: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25475 is a path traversal vulnerability in OpenClaw, a personal AI assistant, affecting the isValidMedia() function in src/media/parse.ts. The flaw allows authenticated low-privileged users to read arbitrary files accessible to the OpenClaw agent process by crafting MEDIA: tokens pointing to arbitrary file paths. All versions up to and including 2026.1.29 are affected; the fix was introduced in version 2026.1.30 (and further refined in 2026.2.1). It carries a CVSS v3.1 base score of 6.5 (Medium) per the GitHub Advisory Database (GitHub Advisory, OpenClaw Advisory).

The root cause is improper path validation (CWE-22) combined with sensitive information exposure (CWE-200) in the isValidMedia() function within src/media/parse.ts. The function naively returns true for any candidate path beginning with /, ./, ../, or ~, without verifying that the resolved path falls within a designated safe media directory. When an agent emits a MEDIA: token (e.g., MEDIA:/etc/passwd or MEDIA:~/.ssh/id_rsa), OpenClaw stages and transmits the referenced file as a media attachment to the requesting user or channel. Exploitation requires only low-privilege network access and no user interaction, making it straightforward for any authenticated agent user to trigger (GitHub Advisory, OpenClaw Advisory).

Vulnerable code pattern:

function isValidMedia(candidate: string, opts?: { allowSpaces?: boolean }) {
  if (candidate.startsWith("/")) return true;   // ALLOWS /etc/passwd
  if (candidate.startsWith("./")) return true;
  if (candidate.startsWith("../")) return true;  // ALLOWS ../../etc/passwd
  if (candidate.startsWith("~")) return true;    // ALLOWS ~/secrets
  return false;
}

Successful exploitation results in complete confidentiality compromise of any file readable by the OpenClaw agent process user, with no impact on integrity or availability. Sensitive data at risk includes SSH private keys (~/.ssh/id_rsa), cloud provider credentials (~/.aws/credentials), API keys stored in .env or config.json, and system files such as /etc/passwd and /etc/shadow. Exfiltrated credentials could enable lateral movement to cloud infrastructure, remote systems, or other services, significantly amplifying the blast radius beyond the initial OpenClaw deployment (GitHub Advisory, OpenClaw Advisory).

No confirmed in-the-wild exploitation has been reported, and no standalone public proof-of-concept exploit code is known to exist beyond the PoC payloads documented in the advisory itself. The EPSS score is approximately 0.13% (32nd percentile), indicating a low near-term exploitation probability. The vulnerability is detected by Qualys (ID: 5007413) and Nessus (ID: 298450), and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Media coverage under the "ClawJacked" moniker has raised community awareness, potentially increasing exploitation interest (GitHub Advisory, Feedly).

1. Reconnaissance: Identify OpenClaw deployments running versions ≤ 2026.1.29 (npm package openclaw) accessible over the network. Check version via npm or package metadata.
2. Authenticate: Obtain low-privilege credentials for the target OpenClaw instance — only standard user-level access is required.
3. Craft malicious MEDIA token: Prepare a message or agent instruction that causes the OpenClaw agent to emit a MEDIA: token referencing a sensitive file path, such as:
   • MEDIA:/etc/passwd
   • MEDIA:~/.ssh/id_rsa
   • MEDIA:~/.aws/credentials
   • MEDIA:../../../etc/shadow
4. Trigger file staging: Submit the crafted input to the OpenClaw agent via the chat/channel interface. The isValidMedia() function accepts the path without restriction and OpenClaw stages the file for transmission.
5. Receive exfiltrated file: The contents of the targeted file are delivered to the requesting user or channel as a media attachment, completing the data exfiltration (GitHub Advisory, OpenClaw Advisory).

• Logs: OpenClaw application logs showing MEDIA: tokens referencing absolute paths (e.g., /etc/, /root/, ~/.ssh/, ~/.aws/) or directory traversal sequences (../) in agent output streams.
• File System: Unexpected access timestamps on sensitive files such as /etc/passwd, /etc/shadow, ~/.ssh/id_rsa, ~/.aws/credentials, or .env files coinciding with OpenClaw process activity.
• Network: Outbound data transfers from the OpenClaw server containing file contents delivered as media attachments to external users or channels; unusual volume of media staging activity.
• Process: OpenClaw process (node) opening file descriptors to paths outside the designated media directory, observable via lsof or auditd file access logs.

Upgrade OpenClaw to version 2026.1.30 or later (the fix commit is 34e2425b4d92e8aa8c3fdf11d5dc6b49d5849abb, PR #4930); version 2026.2.1 further restricts inbound media staging to the OpenClaw media directory. If an immediate upgrade is not possible, run OpenClaw under a dedicated least-privilege OS user account that has no access to sensitive files such as SSH keys, cloud credentials, or system files. Additionally, restrict network access to OpenClaw deployments and monitor for MEDIA: tokens referencing paths outside the expected media directory (OpenClaw Advisory, GitHub Advisory).

The vulnerability received notable media coverage under the name "ClawJacked", with articles published by The Hacker News and several security blogs describing how malicious sites could hijack local OpenClaw AI agents via WebSocket to trigger file exfiltration (The Hacker News). The vulnerability appeared in SOS Intelligence's CVE Chatter Weekly Top Ten for multiple consecutive weeks (March–May 2026), indicating sustained community interest. Security researchers published technical write-ups on dev.to and HackerNoon exploring the broader implications for local AI agent security. The Barrack AI blog and Collabnix community also covered the issue in the context of OpenClaw's overall security posture (Feedly).