What’s Vulnerable › Vulnerabilities

CVE-2026-26321: OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-19 · updated 2026-06-17
• Weakness: CWE-22

Description

OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as `/etc/passwd` as `mediaUrl`. Upgrade to OpenClaw `2026.2.14` or newer to receive a fix. The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions.

Affected products

• OpenClaw: before 2026.2.14 — fixed in 2026.2.14

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.14. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/5b4121d6011a48c71e747e3c18197f180b872c5d
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8jpq-5h99-ff5r

Get alerted when CVE-2026-26321 or the next vulnerability affects your stack