PT-2026-26005 · Openclaw · Openclaw

Sean Nejad

·

Published

2026-02-19

·

Updated

2026-03-19

·

CVE-2026-22171

CVSS v2.0

9.4

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.19
Description OpenClaw contains a path traversal issue in the Feishu media download process. Untrusted media keys are directly used in constructing temporary file paths within the extensions/feishu/src/media.ts file. An attacker controlling the Feishu media key values returned to the client can utilize traversal segments to bypass the os.tmpdir() directory and write arbitrary files with the permissions of the OpenClaw process. The issue stems from the direct interpolation of untrusted input (imageKey / fileKey) into file paths. This allows for manipulation of the path, potentially leading to file writes outside the intended temporary directory.
Recommendations Update OpenClaw to version 2026.2.19 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-05043
CVE-2026-22171
GHSA-VJ3G-5PX3-GR46

Affected Products

Openclaw