← Database

CVE-2026-41366

MEDIUM CVSS: 5.5 Published: 2026-04-28 Modified: 2026-07-24

Description

OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.

Affected Platforms

Openclaw Openclaw

Weakness Type

CWE-732

References