CVE-2026-22171: OpenClaw path traversal

CISO Take

OpenClaw's Feishu media download flow interpolates attacker-influenced media keys directly into temporary file paths, letting a remote, unauthenticated actor escape os.tmpdir() and write arbitrary files with the permissions of the OpenClaw agent process. This matters because OpenClaw is an AI agent framework that often runs with broad filesystem and integration access, so a file-write primitive here can be leveraged to overwrite agent configuration or extension code rather than just drop a stray file. The bug isn't in CISA KEV, has no public exploit or Nuclei template, and sits at the 74th EPSS percentile with a CISA SSVC "Track" decision — real but not yet an active-exploitation emergency — while its blast radius is limited to 4 known downstream dependents. CISOs running OpenClaw with the Feishu extension enabled should upgrade to 2026.2.19 or later immediately, since network access with zero privileges or user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) is a low bar for exploitation. Until patched, disable or tightly scope the Feishu integration and monitor for unexpected file writes outside the agent's expected temp directory.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS vulncheck.com

What is the risk?

Network-exploitable with no privileges or user interaction required (AC:L, PR:N, UI:N) gives this a low barrier to entry, and the CVSS 8.2 reflects a meaningful confidentiality/integrity impact from arbitrary file writes inside the OpenClaw process. Mitigating factors are the absence of a public exploit or scanner template, no CISA KEV listing, an EPSS score that places it in the top 74th percentile (elevated but not top-tier), and a CISA SSVC "Track" rather than "Act" decision. Exposure is bounded by the fact that exploitation requires the victim to have the Feishu extension enabled and to receive attacker-influenced media keys, and the package has only 4 tracked downstream dependents — but the package itself carries 425 other recorded CVEs and an unknown OpenSSF Scorecard, suggesting weak overall security hygiene that could compound this issue. Overall: high-severity, moderate near-term exploitation likelihood, currently opportunistic rather than actively weaponized.

How does the attack unfold?

Initial Access

Attacker controls or influences a Feishu media key value that is returned to the OpenClaw client during a media download request.

AML.T0049

Path Traversal Exploitation

The untrusted media key, containing traversal segments, is interpolated unsanitized into the temp file path in media.ts, escaping os.tmpdir().

Arbitrary File Write

OpenClaw writes attacker-controlled content to an arbitrary filesystem location with the permissions of its own process.

Persistence / Follow-on Compromise

Written files can overwrite agent configuration or extension code to achieve persistence or escalate toward code execution on the next agent load.

AML.T0081

Initial Access

Attacker controls or influences a Feishu media key value that is returned to the OpenClaw client during a media download request.

AML.T0049

Path Traversal Exploitation

The untrusted media key, containing traversal segments, is interpolated unsanitized into the temp file path in media.ts, escaping os.tmpdir().

Arbitrary File Write

OpenClaw writes attacker-controlled content to an arbitrary filesystem location with the permissions of its own process.

Persistence / Follow-on Compromise

Written files can overwrite agent configuration or extension code to achieve persistence or escalate toward code execution on the next agent load.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

Upgrade OpenClaw to version 2026.2.19 or later, which contains the three referenced patch commits closing the traversal path in the Feishu media handler. If immediate patching isn't possible, disable the Feishu extension/channel or restrict which Feishu workspaces/bots can deliver media to the agent, since the attacker needs control over media key values returned to the client. Validate and canonicalize any file paths derived from external media identifiers, rejecting values containing traversal sequences (../, encoded variants) before they touch the filesystem. For detection, monitor OpenClaw process file writes for paths outside the expected os.tmpdir() sandbox, and audit recent Feishu-sourced media downloads for anomalous filenames containing path traversal characters.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0079 - Stage Capabilities AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.4 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience testing

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-22171?

OpenClaw's Feishu media download flow interpolates attacker-influenced media keys directly into temporary file paths, letting a remote, unauthenticated actor escape os.tmpdir() and write arbitrary files with the permissions of the OpenClaw agent process. This matters because OpenClaw is an AI agent framework that often runs with broad filesystem and integration access, so a file-write primitive here can be leveraged to overwrite agent configuration or extension code rather than just drop a stray file. The bug isn't in CISA KEV, has no public exploit or Nuclei template, and sits at the 74th EPSS percentile with a CISA SSVC "Track" decision — real but not yet an active-exploitation emergency — while its blast radius is limited to 4 known downstream dependents. CISOs running OpenClaw with the Feishu extension enabled should upgrade to 2026.2.19 or later immediately, since network access with zero privileges or user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) is a low bar for exploitation. Until patched, disable or tightly scope the Feishu integration and monitor for unexpected file writes outside the agent's expected temp directory.

Is CVE-2026-22171 actively exploited?

No confirmed active exploitation of CVE-2026-22171 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22171?

Upgrade OpenClaw to version 2026.2.19 or later, which contains the three referenced patch commits closing the traversal path in the Feishu media handler. If immediate patching isn't possible, disable the Feishu extension/channel or restrict which Feishu workspaces/bots can deliver media to the agent, since the attacker needs control over media key values returned to the client. Validate and canonicalize any file paths derived from external media identifiers, rejecting values containing traversal sequences (`../`, encoded variants) before they touch the filesystem. For detection, monitor OpenClaw process file writes for paths outside the expected os.tmpdir() sandbox, and audit recent Feishu-sourced media downloads for anomalous filenames containing path traversal characters.

What systems are affected by CVE-2026-22171?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent plugin/extension integrations, AI agent messaging/channel integrations.

What is the CVSS score for CVE-2026-22171?

CVE-2026-22171 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent plugin/extension integrationsAI agent messaging/channel integrations

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0079 Stage Capabilities

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw process permissions.

Exploitation Scenario

An adversary who controls or can influence a Feishu bot/workspace connected to a victim's OpenClaw agent crafts a media message whose media key contains directory traversal sequences (e.g., `../../../`). When the OpenClaw agent processes this Feishu message and attempts to download the referenced media, media.ts builds the local temp file path directly from the untrusted key, causing the write to land outside os.tmpdir() — for example, overwriting an agent configuration file, a startup script, or a credential file the OpenClaw process can access. From there, the attacker can achieve persistence (modified agent config that loads a malicious extension) or escalate toward code execution the next time the agent restarts or loads the tampered file, all without needing any credentials or user interaction beyond the victim's OpenClaw instance being reachable and Feishu-integrated.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.