CVE-2026-22171

Katalog CVE

CVSS 9.1 · Critical EPSS 0,34%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada openclaw. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46 mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871 patch
• https://github.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705 patch
• https://github.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473f patch
• https://www.vulncheck.com/advisories/openclaw-path-traversal-in-feishu-media-temporary-file-naming advisory pihak ketiga