by Kastro
Paper/Archive/CVE-2026-22171

CVE-2026-22171

OpenClaw OpenClaw — OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 28.1.281 × 205.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.

Affected

ProductAffectedFixed inSource
OpenClaw< 2026.2.192026.2.19CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
VulnCheck (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorygithub.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46patchgithub.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871patchgithub.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705patchgithub.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473fwriteupvulncheck.com/advisories/openclaw-path-traversal-in-feishu-media-temporary-file-naming