Staging Environment: Content and features may be unstable or change without notice.
Advisory details: vulnrichment / CVE-2026-22171
Advisory ID vulnrichment/CVE-2026-22171
Aliases
Summary OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
System Score Found at
cvssv3.1 8.2
cvssv4 8.8
ssvc Track
Reference id Reference type URL
c821099157a9767d4df208c6b12f214946507871 Other https://github.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871
cdb00fe2428000e7a08f9b7848784a0049176705 Other https://github.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705
ec232a9e2dff60f0e3d7e827a7c868db5254473f Other https://github.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473f
GHSA-vj3g-5px3-gr46 Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46
openclaw-path-traversal-in-feishu-media-temporary-file-naming Advisory https://www.vulncheck.com/advisories/openclaw-path-traversal-in-feishu-media-temporary-file-naming
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Found at None
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N Found at None
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T14:04:18Z/ Found at None

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-18T14:04:18Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/22xxx/CVE-2026-22171.json

Source Advisory: vulnrichment/CVE-2026-22171

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]