CVE-2026-41363
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension's resolveUploadInput function, bypassing file-system sandbox restrictions.
Risk Assessment
Attackers can read arbitrary files outside configured localRoots boundaries, potentially leading to sensitive data disclosure.
Recommendation
Update OpenClaw to a version later than 2026.3.24 that includes a fix.
Original NVD description (English source)
OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operations to read arbitrary files outside configured localRoots boundaries.