CVE-2026-100526

Name of the Vulnerable Software and Affected Versions @openclaw/discord versions prior to 2026.9.3

Description The Discord integration for OpenClaw fails to maintain the sender-scoped media policy during emoji and sticker upload actions before a local file is loaded. An authorized sender can bypass configured media root restrictions to read a host path and include bytes from an out-of-policy local file in an outbound upload. This requires access to the guild asset action and knowledge of a valid local path. This issue does not allow for code execution or unrestricted filesystem browsing.

Recommendations Update @openclaw/discord to version 2026.9.3.