提交 #875794: OpenClaw openclaw <= 2026.3.14 Path Traversal / Sandbox Escape (CWE-22)

# Technical Details
A sandbox media root bypass exists in `normalizeSandboxMediaParams` in `src/infra/outbound/message-action-params.ts` and in `handlePluginAction` in `src/infra/outbound/message-action-runner.ts` of OpenClaw.

The application validates only selected media parameter keys such as `media`, `path`, and `filePath`. Keys used by channel plugins, including `mediaUrl` and `fileUrl`, are not normalized against the sandbox root. The dispatch path also omits `mediaLocalRoots`, causing plugins to fall back to broader default media roots and allowing files from other agent workspaces to be read.

# Vulnerable Code
File: src/infra/outbound/message-action-params.ts
Method: normalizeSandboxMediaParams
Why: The hardcoded media key list does not include `mediaUrl` or `fileUrl`, so those parameters bypass sandbox path validation.

File: src/infra/outbound/message-action-runner.ts
Method: handlePluginAction
Why: The channel dispatch context omits `mediaLocalRoots`, so downstream plugin media loading can use default roots that cover the broader OpenClaw workspace tree.

# Reproduction
1. Create two agent workspaces, for example Agent-A and Agent-B, under the OpenClaw workspace directory.
2. Place a secret file in Agent-B's workspace.
3. From Agent-A, invoke a message action with a parameter such as `{ "mediaUrl": "/root/.openclaw/workspace/agent-b/secret_key.txt" }`.
4. Observe that `normalizeSandboxMediaParams` does not reject the `mediaUrl` path and the plugin media loader can read the Agent-B file.
5. Compare with the `media` key, which is blocked by sandbox validation when it points outside Agent-A's sandbox.

# Impact
- Sandbox escape between agent workspaces.
- Disclosure of API keys, secrets, logs, session data, and configuration files stored in other agents' workspaces.
- Breaks the intended multi-agent workspace isolation boundary.

Reference Link: https://gist.github.com/YLChen-007/8dab2bac26916a41acf1da5fa4a877eb ;

• 来源: ⚠️ https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg
• 用户: AbamaYouLong (UID 99186)
• 提交: 2026-07-01 08時28分 (3 月前)
• 管理: 2026-08-17 11時45分 (2 months later)
• 状态: 重复
• VulDB条目: 356906 [OpenClaw 直到 2026.3.23 Configuration Data fileUrl 目录遍历]
• 积分: 0