CVE-2026-100549
MEDIUMCVSS 5.4Description
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended staging directory to other process-writable locations.
Timeline
Published:September 26th, 2026 3:17 AM
Last modified:September 29th, 2026 5:17 PM
CVSS Scoring
CVSS v3: 5.4 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute