CVE-2026-27522 — OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions

Affected: OpenClaw

OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary host files accessible by the runtime user.

GHSA-fqcm-97m6-w7rm — OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset

Affected: npm: openclaw

## Impact `sendAttachment` and `setGroupIcon` message actions could hydrate media from local absolute paths when `sandboxRoot` was unset, bypassing intended local media root checks. This could allow reads of arbitrary host files reachable by the runtime user when an authorized message-action path was triggered.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version at triage: `2026.2.23` - Vulnerable: `<= 2026.2.23` - Patched in code: `>= 2026.2.24` (planned next release)

## Remediation Upgrade to `openclaw` `2026.2.24` or later once published.

## Fix Commit(s) - 270ab03e379f9653e15f7033c9830399b66b7e51

## Release Process Note `patched_versions` is pre-set to the planned next release (`>= 2026.2.24`). Once that npm release is published, this advisory can be published without further field edits.

OpenClaw thanks @GCXWLP for reporting.

### Publication Update (2026-02-25) `openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.

Most recent entries from all

CVE-2026-27522 — OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions

GHSA-fqcm-97m6-w7rm — OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset