CVE-2026-42424
MEDIUM
NVD
CVSS Score
5.7
Severity
MEDIUM
Published
Apr 28, 2026
Vendor
unknown
Description
OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media.