OpenClaw has a LFI in BlueBubbles media path handling
Summary
The BlueBubbles extension accepted attacker-controlled local filesystem paths via mediaPath and could read arbitrary local files from disk before sending them as media attachments.
Details
When sendBlueBubblesMedia received a non-HTTP media source, the previous implementation resolved it to a local path and read it directly from disk. There was no required allowlist of safe directories, so values like /etc/passwd (or equivalent sensitive paths on other platforms) could be requested and exfiltrated.
The fix hardens local media loading by requiring explicit configured roots (channels.bluebubbles.mediaLocalRoots) and by enforcing canonical-path containment checks before reading local files. Paths outside allowed roots are rejected.
Fix PR: https://github.com/openclaw/openclaw/pull/16322 Fix commit: https://github.com/openclaw/openclaw/commit/71f357d9498cebb0efe016b0496d5fbe807539fc
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
< v2026.2.14 - Fixed:
>= v2026.2.14(planned)
Impact
An attacker able to trigger BlueBubbles media sends could exfiltrate local files accessible to the OpenClaw process.
Remediation
Upgrade to a release that includes commit 71f357d9498cebb0efe016b0496d5fbe807539fc and configure channels.bluebubbles.mediaLocalRoots to explicit trusted directories.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.2.14 | 2026.2.14 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-rwj8-p9vq-25gv
- https://github.com/openclaw/openclaw/pull/16322
- https://github.com/openclaw/openclaw/commit/71f357d9498cebb0efe016b0496d5fbe807539fc
- https://github.com/openclaw/openclaw
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
openclaw- Disclosed
- 18.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rwj8-p9vq-25gv - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw has a LFI in BlueBubbles media path handling this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.