OpenClaw BlueBubbles: When Your iMessage Bridge Becomes a Spy

Vulnerability ID: GHSA-RWJ8-P9VQ-25GV

CVSS Score: 8.6

Published: 2026-02-18

A critical Path Traversal vulnerability in the OpenClaw BlueBubbles extension allowed attackers to exfiltrate sensitive local files via message attachments. By manipulating the media delivery pipeline, a malicious actor (or a confused AI) could trick the system into reading arbitrary files from the host server—such as SSH keys or password hashes—and sending them directly to an iMessage chat. The flaw stemmed from a lack of directory containment checks in the sendBlueBubblesMedia function.

TL;DR

The OpenClaw BlueBubbles extension failed to validate file paths when sending media. Attackers could request the bot to send system files (like /etc/passwd) as attachments, leading to full information disclosure. Fixed in v2026.2.14 by enforcing a strict allowlist of directories.

⚠️ Exploit Status: POC

Technical Details

• 
  CWE ID: CWE-22


• 
  Weakness Name: Path Traversal


• 
  CVSS v3.1: 8.6 (High)


• 
  Attack Vector: Network


• 
  Privileges Required: Low/None (Context Dependent)


• 
  Impact: Information Disclosure

Affected Systems

• OpenClaw Framework


• OpenClaw BlueBubbles Extension


• 
  OpenClaw: < v2026.2.14 (Fixed in: v2026.2.14)

Code Analysis

Commit: 71f357d

fix(bluebubbles): confine local media paths to configured roots

@@ -10,2 +10,12 @@

+    if (mediaLocalRoots) {

+      assertLocalMediaPathAllowed(localPath, mediaLocalRoots);

+    }

Exploit Details

• 
  GitHub: Unit test PoC included in the patch commit showing blocked access to /etc/passwd

Mitigation Strategies

• Implement strict allowlisting for file access.


• Use canonicalization (realpath) to resolve paths before validation.


• Run the application with least-privilege user permissions.

Remediation Steps:

1. Upgrade OpenClaw to version v2026.2.14 or later.


2. Configure the mediaLocalRoots setting in your OpenClaw config to explicitly list allowed directories.


3. Audit your system logs for any 'Access denied' errors related to media paths to detect attempted exploitation.

References

• OpenClaw Repository


• GHSA Advisory

Read the full report for GHSA-RWJ8-P9VQ-25GV on our website for more details including interactive diagrams and full exploit analysis.