PT-2026-37018 · Openclaw · Openclaw

Feiyang666 · Published 2026-04-17 · Updated 2026-05-06 · CVE-2026-43533

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description An arbitrary file read issue exists in QQBot media tags. Attackers can craft malicious reply text containing media tags to reference host-local paths outside the intended media storage boundary, leading to the disclosure of arbitrary local files through outbound media handling.

Recommendations Update to version 2026.4.10 or newer.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2026-43533

GHSA-66R7-M7XM-V49H

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/604777e4414cc3b2ff8861f18f4fb04374c702c6 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-66r7-m7xm-v49h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43533 · Security Note
• https://osv.dev/vulnerability/GHSA-66r7-m7xm-v49h · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/63271 · Note
• https://vulncheck.com/advisories/openclaw-arbitrary-local-file-read-via-qqbot-media-tags · Note
• https://twitter.com/vuldb/status/2051824908217524337 · Twitter Post
• https://t.me/CVEtracker/52733 · Telegram Post