OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension

高 7.5CVE-2026-26321 · GHSA-8jpq-5h99-ff5r · 19/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-26321 は openclaw (openclaw), openclaw に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.53%（全脆弱性の 45.1% より高い）。
対処：2026.2.14 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openclaw openclaw	`< 2026.2.14`	`2026.2.14`
openclaw npm	`< 2026.2.14`	`2026.2.14`

概要

Summary

The Feishu extension previously allowed sendMediaFeishu to treat attacker-controlled mediaUrl values as local filesystem paths and read them directly.

Affected versions

< 2026.2.14

Patched versions

>= 2026.2.14

Impact

If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as /etc/passwd as mediaUrl.

Remediation

Upgrade to OpenClaw 2026.2.14 or newer.

Notes

The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.

Fix commit 5b4121d60 confirmed on main and in v2026.2.14. Upgrade to openclaw >= 2026.2.14.

NVD の説明

OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`. Upgrade to OpenClaw `2026.2.14` or newer to receive a fix. The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.

参考情報

openclaw/openclaw security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-26321 · ADVISORY
openclaw/openclaw commit 5b4121d · WEB
openclaw/openclaw · PACKAGE
openclaw/openclaw release v2026.2.14 · WEB

openclaw のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

openclaw

< 2026.2.14

2026.2.14