PT-2026-26005 · Openclaw · Openclaw

Sean Nejad · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-22171

NVD

CVSS v3.1

8.2

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-22171

Affected Products

Openclaw

References · 6

• https://github.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871 · Patch
• https://github.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473f · Patch
• https://github.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22171 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46 · Note
• https://vulncheck.com/advisories/openclaw-path-traversal-in-feishu-media-temporary-file-naming · Note