CVE-2026-22171

high

Description

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.

References

Advisories
More

https://www.vulncheck.com/advisories/openclaw-path-traversal-in-feishu-media-temporary-file-naming

https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46

https://github.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473f

https://github.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705

https://github.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871

Details

Source: Mitre, NVD

Published: 2026-03-18

Updated: 2026-03-19

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

CVSS v4

Base Score: 8.8

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00031