CVE-2026-22171: Path Traversal in OpenClaw

The core of the vulnerability lies in OpenClaw's handling of imageKey and fileKey values received from Feishu during media downloads. These keys are directly interpolated into temporary file paths without proper sanitization. An attacker who can control these Feishu media keys—for instance, through a compromised upstream Feishu response—can craft malicious keys containing path traversal sequences (e.g., ../). This allows them to escape the intended temporary directory and write files to arbitrary locations within the OpenClaw process's file system. The impact is limited to the permissions of the OpenClaw process itself, but this could still allow for the modification or deletion of critical configuration files, potentially leading to denial of service or even remote code execution if the process has elevated privileges. While not directly exploitable for full system compromise, the ability to write arbitrary files represents a significant security risk.

1. Reserved2026-01-06
2. Published2026-03-03
3. Modified2026-03-19
4. EPSS updated2026-03-25

The primary mitigation for CVE-2026-22171 is to immediately upgrade OpenClaw to version 2026.2.19 or later. This version includes a fix that properly sanitizes the Feishu media keys before they are used in file path construction. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the imageKey and fileKey parameters. Additionally, restrict access to the media download endpoint to trusted sources only. Regularly review and audit the OpenClaw configuration to ensure that the process is running with the least necessary privileges. After upgrading, confirm the fix by attempting a media download with a crafted imageKey containing path traversal characters; the download should be denied.