Executive brief
OpenClaw is a library for building QQ Bot integrations with AI capabilities. The vulnerability allows an AI-generated reply containing specially crafted media tags to read and exfiltrate arbitrary files from the server's local filesystem, such as configuration files, SSH keys, or credentials stored outside the intended media storage directory. This could lead to unauthorized access to sensitive data stored on the system running the bot.
Technical details
This is a path traversal vulnerability (CWE-22) in the QQBot media tag handling code. The five outbound media-sending functions (sendPhoto, sendVoice, sendVideoMsg, sendDocument, sendMedia) in outbound.ts used resolveQQBotLocalMediaPath() which performed no boundary enforcement on local file paths—accepting any existing file on disk. An attacker could craft AI-generated reply text containing media tags (e.g., <qqfile>/etc/passwd</qqfile>) that reference files outside the intended media storage directory. The vulnerable code would read and send these files via the QQ Bot API, resulting in local file disclosure. The fix (merged in PR #63271) enforces media storage boundary validation using realpathSync and isPathWithinRoot checks on all outbound media paths, matching the protection already applied to structured payload paths. Authentication is required (user interaction to trigger AI reply generation), and the attack vector is network-based through the bot's reply mechanism.
Affected products
- OpenClaw OpenClaw < 2026.4.10
Timeline
- 2026-04-17: disclosed
- 2026-04-10: patched: Fix released in v2026.4.10; latest npm release v2026.4.14 includes the fix