CVE Intelligence
Analysis AI-assisted

CVE-2026-22171: OpenClaw: Path Traversal in Feishu Media Temporary Files

CVE-2026-22171 affects OpenClaw versions before 2026.2.19 and involves a path traversal flaw in the Feishu media download flow, where media keys are placed unsafely into temporary file paths. NVD rates it critical with a CVSS 3.1 base score of 9.1, while VulnCheck also publishes lower CVSS scores. The sources consulted show no KEV listing and no confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-22171 is a path traversal weakness (CWE-22) in the OpenClaw Feishu media download flow. Media key values that are not trusted are placed into temporary file names without adequate validation, so path segments in those values can move the resulting path outside the intended temporary directory.

Impact

The description states that an attacker who can control Feishu media key values returned to the client may write arbitrary files within the permissions of the OpenClaw process. The record's SSVC data lists technical impact as partial and automatable as yes.

  • Confidentiality and integrity impact are rated high in the NVD CVSS 3.1 vector.
  • Availability impact is rated none in the NVD CVSS 3.1 vector.
  • Practical impact depends on the permissions of the OpenClaw process and the deployment.

Affected products and versions

  • Product: Openclaw Openclaw.
  • Affected range in the record: versions before 2026.2.19.

Exploitation status

The KEV catalog entry for this CVE is not listed in the record. The EPSS probability is 0.00345 with a percentile of 0.26875. The SSVC exploitation field is none. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Upgrade OpenClaw to version 2026.2.19 or later, which is the boundary of the affected range in the record.
  • Review the patch commits referenced by the vendor, including commit c821099, commit cdb00fe and commit ec232a9.
  • Follow the vendor security advisory GHSA-vj3g-5px3-gr46 for mitigation guidance.
  • Until patched, limit the filesystem permissions of the OpenClaw process and restrict which systems can influence media metadata returned to the client.

Detection guidance

  • Review application logs and file creation events in the OpenClaw temporary media area for files written outside the expected temporary directory.
  • Monitor for unexpected files created by the OpenClaw process in locations it does not normally use.
  • Treat unusual media key values in Feishu integration traffic as a signal to investigate.

Limitations of the available information

The record does not describe the exact exploit conditions, the required privileges of the attacker, or the full list of affected deployments. The record also contains multiple CVSS scores from different providers, which differ from each other. The EPSS date field in the record is not used for analysis here because it does not clearly align with the publication date.

Frequently asked questions

Which OpenClaw versions are affected by CVE-2026-22171?

The record lists OpenClaw versions before 2026.2.19 as affected. Check your installed version and upgrade to 2026.2.19 or later.

Is this CVE known to be actively exploited?

The record shows no KEV listing, and no confirmed exploitation appears in the sources consulted. Keep monitoring official sources.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.