Descrição
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.
CVSS 5.3EPSS 0.33899999999999997%Risco 0.55
Ver fonte- Publicação
- 2026-04-28 00:16:25
- Versões afetadas
- <2026.3.24
- Tipo
- Core software
- Última alteração
- 2026-07-24 21:10:00
- Vetor
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N