EUVD-2026-26117Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible upload endpoints require authenticated (PR:L) access; no integrity or availability impact; scope unchanged as traversal stays within application process.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries. Attackers can exploit upload_file and upload_image endpoints to access files beyond the intended workspace-only filesystem policy.
AnalysisAI
Filesystem policy bypass in OpenClaw's Feishu docx upload pipeline (upload_file and upload_image endpoints) enables authenticated users to read local files outside the intended workspace-only boundary via path traversal. All npm versions of openclaw prior to 2026.4.8 are affected; this is explicitly an incomplete fix of a prior advisory (GHSA-qf48-qfv4-jjm9), indicating the original control was partially circumvented. No active exploitation has been identified - SSVC rates exploitation as none, EPSS sits at 0.04% (12th percentile), and the vulnerability is absent from CISA KEV - with a vendor-confirmed patch available at version 2026.4.8.
Technical ContextAI
OpenClaw is an npm-distributed local AI assistant with Feishu document integration. CWE-22 (Path Traversal) describes the root cause: user-supplied file paths embedded in Feishu docx upload blocks are not adequately constrained to the workspace directory before file I/O operations, allowing traversal sequences to escape the intended sandbox. The vulnerability surfaces specifically during processing of upload_file and upload_image docx block types. Because this is a second-generation fix of GHSA-qf48-qfv4-jjm9, the original sanitization logic contained an insufficiently broad constraint that left an exploitable residual path. CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all affected versions; the fixed tree is confirmed at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 on npm version 2026.4.8.
RemediationAI
Upgrade the openclaw npm package to version 2026.4.8 or later; this is the vendor-released patch confirmed at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5, with regression tests for the affected security boundary per the GHSA advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-5fc7-f62m-8983. If an immediate upgrade is not possible, restrict or disable processing of Feishu docx files containing upload_file and upload_image blocks from untrusted or external sources - this eliminates the attack surface entirely since the vulnerability is confined to that code path. Additionally, network-level access controls limiting which users can reach the upload endpoints reduce exposure in shared or networked deployments. Note that disabling Feishu docx upload functionality may break legitimate document import workflows.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today