Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

OpenClaw Feishu Extension Allows Unrestricted File Access

published 6 months ago

Summary

The OpenClaw Feishu extension in certain versions allows attackers to read any file on the system, even if it's not supposed to be accessible. This is a serious security risk because sensitive information could be stolen. Update to the latest version of OpenClaw to fix this issue.

What to do

Update GitHub Actions openclaw to version 2026.3.28.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	openclaw	>= 2026.2.6, < 2026.3.28 Fix: upgrade to 2026.3.28

Original advisory text

Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qf48-qfv4-jjm9. This link is maintained to preserve external references.

### Original Description
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.3 High

Type

CWE-22Path Traversal

Timeline

Published28 Apr 2026

Updated6 May 2026

First seen6 May 2026

Sources

GHSA-qp56-gp47-jwj3 · OSV

Track software like this

Free during beta