N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-x9cf-3w63-rpq9

GHSA-x9cf-3w63-rpq9: OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia

Summary

When iMessage remote attachment fetching is enabled (channels.imessage.remoteHost), stageSandboxMedia accepted arbitrary absolute paths and used SCP to copy them into local staging.

If a non-attachment path reaches this flow, files outside expected iMessage attachment directories on the remote host can be staged.

Affected Packages / Versions

Package: openclaw
Affected: up to and including 2026.2.17 (latest npm version as of February 19, 2026)
Fixed: pending next release with remote attachment path validation

Impact

Confidentiality impact. An attacker who can influence inbound attachment path metadata may disclose files readable by the OpenClaw process on the configured remote host.

Attack Preconditions

iMessage attachments enabled (channels.imessage.includeAttachments=true), and
remote attachment mode active (channels.imessage.remoteHost configured or auto-detected), and
attacker can inject/tamper with attachment path metadata.

Given these preconditions, this advisory is assessed as medium severity.

Fix Commit(s)

1316e5740382926e45a42097b4bfe0aef7d63e8e

Release Process Note

patched_versions should be set to the next released npm version that includes remote attachment path validation, then the advisory can be published.

Mitigation

Upgrade to the first release that includes remote attachment path validation.
If remote attachments are not required, disable iMessage attachment ingestion.
Run OpenClaw under least privilege on the remote host.

OpenClaw thanks @zpbrent for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-x9cf-3w63-rpq9

GHSA-x9cf-3w63-rpq9:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.19	2026.2.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in OpenClaw's iMessage integration, leading to sensitive file disclosure. The root cause is the failure to properly sanitize and validate file paths for attachments, particularly when fetching them from a remote host using SCP. An attacker who can control the attachment path metadata in an inbound iMessage can exploit this weakness.

The analysis of the patch 1316e5740382926e45a42097b4bfe0aef7d63e8e reveals several key functions that were part of the vulnerable execution flow:

monitorIMessageProvider: This function is the initial entry point for handling incoming iMessages. It was vulnerable because it accepted attachment paths without validating them against an allowlist of safe directories. This allowed a malicious path to enter the system.
stageSandboxMedia: This function, explicitly mentioned in the advisory, was responsible for copying the attachment. In remote mode, it used scp with the user-provided path. Without proper validation, it could be instructed to copy any file readable by the OpenClaw process on the remote machine.
MediaAttachmentCache.getStatSize: This method was also vulnerable as it accessed the file system using the unchecked attachment path to retrieve file metadata (size). This could be used by an attacker to confirm the existence and size of arbitrary files on the system.

The fix involves introducing a new path validation policy (inbound-path-policy.ts) and applying it in all the identified vulnerable functions. The new isInboundPathAllowed function ensures that attachment paths are restricted to configured safe directories, thus mitigating the path traversal vulnerability.

Vulnerable functions

stageSandboxMedia

src/auto-reply/reply/stage-sandbox-media.ts

This function is responsible for staging media files. When remote attachments are enabled via SCP, this function previously accepted arbitrary absolute paths. This allowed an attacker to specify a path to a sensitive file on the remote host, which would then be copied into the local sandbox, disclosing its contents. The patch introduces a check using `isInboundPathAllowed` to validate that the source path is within the configured `remoteAttachmentRoots`.

monitorIMessageProvider

src/imessage/monitor/monitor-provider.ts

This function processes incoming iMessage notifications and their attachments. Before the fix, it only checked if an attachment had a path, without validating the path itself. This allowed a malicious, user-provided path (e.g., a path traversal payload) to be considered a valid attachment and be passed on to other vulnerable parts of the application, such as `stageSandboxMedia`. The patch adds a call to `isInboundPathAllowed` to ensure the attachment path is within the allowed directories.

MediaAttachmentCache.getStatSize

src/media-understanding/attachments.ts

This method retrieves the file size of an attachment by accessing its path on the filesystem. Prior to the patch, it did not validate the attachment path, making it vulnerable to path traversal. An attacker could craft an attachment with a path pointing to an arbitrary file on the system (e.g., `/etc/passwd`) to check for its existence and get its size. The patch adds a check with `isInboundPathAllowed` and also resolves symlinks to prevent bypasses.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-x9cf-3w63-rpq9: OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia

Summary

Affected Packages / Versions

Impact

Attack Preconditions

Fix Commit(s)

Release Process Note

Mitigation

GHSA-x9cf-3w63-rpq9:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-x9cf-3w63-rpq9: OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia

Summary

Affected Packages / Versions

Impact

Attack Preconditions

Fix Commit(s)

Release Process Note

Mitigation

Technical Details

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI