PT-2026-35803 · Openclaw · Openclaw

Yuki Shiroi · Published 2026-04-09 · Updated 2026-04-29 · CVE-2026-42424

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description OpenClaw treats shared reply MEDIA paths as trusted, which allows crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references, causing another channel to read local file paths as trusted generated media.

Recommendations Update to version 2026.4.8.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-73

CWE-668

Related Identifiers

CVE-2026-42424

GHSA-QQQ7-4HXC-X63C

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qqq7-4hxc-x63c · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42424 · Security Note
• https://osv.dev/vulnerability/GHSA-qqq7-4hxc-x63c · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2049278421000204334 · Twitter Post
• https://vulncheck.com/advisories/openclaw-local-file-exfiltration-via-shared-reply-media-paths · Note
• https://twitter.com/CVEnew/status/2049227499284939058 · Twitter Post