Executive brief
OpenClaw is a library used to integrate QQ Bot (Tencent's chat bot platform) into applications. A vulnerability in how OpenClaw processes structured media payloads allows attackers to read any file on the host system that the OpenClaw process can access, potentially exposing sensitive configuration files, API keys, source code, or customer data.
Technical details
The vulnerability is a path traversal (CWE-22) in OpenClaw's QQ Bot structured media payload handling. Crafted structured payloads can escape the intended media root directory and reference arbitrary file paths on the host filesystem. The attack vector is network-based; an attacker can send a malicious structured payload through the QQ Bot media-send path, where prompt-influenced output could exfiltrate any readable file. No authentication or user interaction is required. The fix restricts local file path access in structured payloads and was patched in version 2026.4.2.
Affected products
- OpenClaw OpenClaw <= 2026.4.1
Timeline
- 2026-04-07: disclosed: Advisory published
- 2026-04-07: patched: Fix staged for version 2026.4.2