CVE-2026-22171

HIGH EPSS 25.8%
Published Mar 18, 20263mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 4.0
High
Find Similar
Published Mar 18, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.

CVSS Details

Base Score
8.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
25.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
openclawopenclaw* <2026.2.19

References 5

  • github.com https://github.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473f
    Patch
  • github.com https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46
    MitigationVendor Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/openclaw-path-traversal-in-feishu-media-temporary-file-naming
    Third Party Advisory

Remediation

  • github.com https://github.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473f
    Patch