Popis
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.
CVSS 5.3EPSS 0.33899999999999997%Riziko 0.55
Zobraziť zdroj- Zverejnené
- 2026-04-28 00:16:25
- Dotknuté verzie
- <2026.3.24
- Typ
- Core software
- Posledná úprava
- 2026-07-24 21:10:00
- Vektor
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N