# OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)

OpenClaw's sandbox media normalization only checks media/path/filePath keys, so mediaUrl/fileUrl let a sandboxed agent read other agents' workspace files.

- Payout: Research
- Severity: high
- Program: OpenClaw
- Found by (vendor credit): Edward-x (@YLChen-007)
- Found by: YLChen-007
- Disclosed: 2026-03-30
- CVE: CVE-2026-35668
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-hr5v-j9h9-xjhg
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-hr5v-j9h9-xjhg
- Tags: area:ai domain:ai impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:docker tech:nodejs technique:source-review vuln:info-disclosure vuln:path-traversal vuln:sandbox-escape

**Target:** Agent sandbox media parameter normalization in messaging pipeline
**Root cause:** normalizeSandboxMediaParams uses a hardcoded allowlist of media/path/filePath keys, omitting mediaUrl and fileUrl used by channel plugins; additionally handlePluginAction drops mediaLocalRoots from the dispatch context, so plugins fall back to default roots covering all of ~/.openclaw/.
**Steps:**
1. Start vulnerable gateway container via `docker compose up -d`.
2. Write secret to `~/.openclaw/workspace/agent-b/secret_key.txt` inside container.
3. Invoke `normalizeSandboxMediaParams` with Agent-A's sandbox policy and `{ mediaUrl: "/root/.openclaw/workspace/agent-b/secret_key.txt" }`.
4. mediaUrl is not in the mediaKeys allowlist so normalization is skipped.
5. handlePluginAction dispatches without mediaLocalRoots; plugin calls loadWebMedia with default roots permitting `~/.openclaw/workspace/**`.
6. Agent-B's secret content is read and returned as channel attachment.
**How found:** Reporter noticed the mediaKeys allowlist in normalizeSandboxMediaParams only covered media/path/filePath while channel extensions (Discord, Telegram, Slack, Matrix, Twitch) use mediaUrl/fileUrl, then traced handlePluginAction and found mediaLocalRoots missing from the dispatch context.
**Exploitation:** A sandboxed agent (or attacker influencing its tool calls via prompt injection) calls the message tool with mediaUrl pointing at another agent's workspace file; the unchecked key skips sandbox validation and the plugin reads the file with default roots, exfiltrating it as a channel attachment.
**Escalation:** Chained with prompt injection or multi-agent interaction to reach arbitrary files across the entire ~/.openclaw/ tree (API keys, session logs, configs).
**Insight:** When a security check uses a hardcoded key allowlist, enumerate every parameter name the downstream plugins actually consume — sibling keys like mediaUrl/fileUrl are common bypasses; also verify the dispatch context forwards the sandbox roots rather than letting plugins fall back to defaults.

## Proof of concept (copied exactly from the original report)

**Exploit invocation with mediaUrl bypassing normalization**

```
python3 poc_exploit.py

3. The exploit writes a secret file to `~/.openclaw/workspace/agent-b/secret_key.txt` inside the container, then invokes `normalizeSandboxMediaParams` with Agent-A's sandbox policy and `{ mediaUrl: <agent-b-secret-path> }`. The `mediaUrl` key bypasses normalization, and `loadWebMedia` reads the file successfully.
```