En bref
- CVE-2026-41363 est une vulnérabilité MOYENNE (CVSS 6.5) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.4% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.28 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | ≥ 2026.2.6, < 2026.3.28
| 2026.3.28
|
| openclaw npm | ≥ 2026.2.6, < 2026.3.28
| 2026.3.28
|
Description
Summary
Feishu upload path resolution could read files outside the configured localRoots sandbox before handing them to the upload path.
Impact
A tool caller constrained to workspace or localRoots paths could exfiltrate arbitrary host files through Feishu upload actions.
Affected Component
extensions/feishu/src/docx.ts
Fixed Versions
- Affected:
>= 2026.2.6, <= 2026.3.24
- Patched:
>= 2026.3.28
- Latest stable
2026.3.28 contains the fix.
Fix
Fixed by commit 764394c78b (fix: enforce localRoots sandbox on Feishu docx upload file reads).
NVD description
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free