Περιγραφή
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.
CVSS 5.3EPSS 0.33899999999999997%Κίνδυνος 0.55
Προβολή πηγής- Δημοσίευση
- 2026-04-28 00:16:25
- Επηρεαζόμενες εκδόσεις
- <2026.3.24
- Τύπος
- Core software
- Τελευταία τροποποίηση
- 2026-07-24 21:10:00
- Διάνυσμα
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N