What is the CVSS score of EUVD-2026-12714?

EUVD-2026-12714 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by EUVD-2026-12714?

OpenClaw versions before 2026.2.19 contain a critical vulnerability allowing attackers to write arbitrary files to systems through compromised Feishu media downloads, potentially enabling malware…. A patch is available.

How to fix or mitigate EUVD-2026-12714?

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.2.19 and assess Feishu integration usage. Within 7 days: Apply vendor patch to upgrade to version 2026.2.19 or later across all affected instances, testing in non-production environments first. Within 30 days: Conduct post-patch validation and review access logs for indicators of exploitation attempts targeting the media download functionality.

Openclaw EUVD-2026-12714

| CVE-2026-22171 HIGH

Path Traversal (CWE-22)

2026-03-18 VulnCheck

GHSA-vj3g-5px3-gr46

Path Traversal Openclaw

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 02:30 euvd

EUVD-2026-12714

Analysis Generated

Mar 18, 2026 - 02:30 vuln.today

Patch released

Mar 18, 2026 - 02:30 nvd

Patch available

CVE Published

Mar 18, 2026 - 01:34 nvd

HIGH 8.2

DescriptionCVE.org

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.

AnalysisAI

OpenClaw contains a path traversal vulnerability in the Feishu media download functionality where untrusted media key values are directly interpolated into temporary file paths without sanitization. OpenClaw versions prior to 2026.2.19 are affected, allowing remote unauthenticated attackers to write arbitrary files within the process permissions by using directory traversal sequences in media keys. No public evidence of active exploitation (KEV) or public proof-of-concept exists at this time, though the high CVSS score of 8.2 reflects the network-accessible attack vector and lack of authentication requirements.

Technical ContextAI

This vulnerability affects the OpenClaw application (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), specifically in the Feishu integration component at extensions/feishu/src/media.ts. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The vulnerability occurs when the application processes media downloads from Feishu (a collaboration platform) and constructs temporary file paths by directly concatenating untrusted media key values with the operating system's temporary directory path from os.tmpdir(). Without proper input validation or path canonicalization, attackers can inject traversal sequences like '../' into media keys to escape the intended temporary directory boundary and write files to arbitrary filesystem locations within the process's permission scope.

RemediationAI

Upgrade OpenClaw to version 2026.2.19 or later, which includes patches addressing the path traversal vulnerability in the Feishu media handling component. Three specific commits address this issue: c821099157a9767d4df208c6b12f214946507871, cdb00fe2428000e7a08f9b7848784a0049176705, and ec232a9e2dff60f0e3d7e827a7c868db5254473f, available at https://github.com/openclaw/openclaw/. Organizations should review the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46 for complete remediation guidance. As a temporary mitigation while patching, organizations can disable the Feishu integration extension if not required for business operations, restrict network access to OpenClaw instances to trusted sources only, and implement file integrity monitoring to detect unauthorized file writes in sensitive directories. Additionally, ensure the OpenClaw process runs with minimal filesystem permissions following the principle of least privilege to limit the scope of potential file writes.