Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

OpenClaw Feishu Media Download Can Write Files Outside of Safe Location

GHSA-vj3g-5px3-gr46 CVE-2026-22171
Summary

OpenClaw's Feishu media download feature can allow an attacker to write files to any location on the server by manipulating the Feishu media key. This is a security risk because it could allow an attacker to gain unauthorized access to the server. To fix this issue, OpenClaw has released a new version (2026.2.19) that ensures media downloads are written to safe locations and validates incoming Feishu keys.

What to do
  • Update steipete openclaw to version 2026.2.19.
Affected software
VendorProductAffected versionsFix available
steipete openclaw <= 2026.2.19 2026.2.19
Original title
OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in exten...
Original description
OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.
osv CVSS4.0 8.3
Vulnerability type
CWE-22 Path Traversal
Published: 18 Mar 2026 · Updated: 18 Mar 2026 · First seen: 18 Mar 2026