CVE-2026-100526

MEDIUM 5.3

Vulnerability in discord

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same sender's configured media roots would otherwise reject, placing bytes from an out-of-policy local file into an outbound emoji or sticker upload. Exploitation requires access to the guild asset action and knowledge or derivation of a useful local path; the issue does not permit unrestricted filesystem browsing or code execution. The issue is fixed in @openclaw/discord 2026.9.3.

CWE	CWE-862
Vendor	openclaw
Product	discord
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for openclaw discord

Be the first to know when new medium vulnerabilities affecting openclaw discord are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

openclaw / discord

0 < 2026.9.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-xvwp-wmh2-fq48 vulncheck.com: https://www.vulncheck.com/advisories/vulnerability-in-discord