Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-42424: OpenClaw 2026.4.8 and earlier: Shared files can be stolen
CVE-2026-42424 · published 6 months ago
Summary
A security issue in OpenClaw versions before 2026.4.8 allows hackers to steal sensitive files from your computer. This happens when a malicious email or message is sent, which can trick the system into revealing the paths of local files. To stay safe, update to the latest version of OpenClaw, version 2026.4.8 or higher.
What to do
- Update openclaw openclaw to version 2026.4.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openclaw | openclaw |
< 2026.4.8 cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
Original advisory text
OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious s...
OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-73External Control of File Name or Path
Timeline
Published28 Apr 2026
Updated3 Nov 2026
First seen28 Apr 2026
Sources
CVE-2026-42424 · NVD
Track software like this
Free during beta