CVE-2026-22171 Details

A path traversal vulnerability has been identified in OpenClaw versions prior to 2026.2.19. This vulnerability arises in the Feishu media download process, where untrusted media keys are directly inserted into temporary file paths. An attacker who can manipulate the Feishu media key values sent to the client can use traversal segments to escape the designated temporary directory and write arbitrary files within the permissions of the OpenClaw process.

Users can update to OpenClaw version 2026.2.19 or later, where this vulnerability has been patched. The update removes the key-derived temporary file naming, replaces it with a secure method that prevents path traversal, and adds a repository guard test to block dynamic 'path.join' patterns that could be exploited.