Executive brief
OpenClaw is a QQ messaging bot framework. The QQBot direct media upload feature failed to properly validate URLs before forwarding requests, allowing attackers to bypass intended security controls and potentially relay requests to unintended destinations via crafted image URLs.
Technical details
This is a server-side request forgery (SSRF) vulnerability (CWE-918) in the QQBot media upload functionality. The uploadC2CMedia and uploadGroupMedia endpoints accepted attacker-controlled image URLs without applying the same SSRF validation checks used by the local download path. An attacker with network access can send crafted image URLs to bypass SSRF protections and relay QQBot media delivery requests to unintended destinations. The vulnerability does not expose arbitrary local files. The fix in version 2026.4.20 adds URL validation to both direct-upload endpoints.
Affected products
- OpenClaw openclaw before 2026.4.20
Timeline
- 2026-04-21: disclosed
- 2026-04-20: patched: version 2026.4.20
- 2026-05-06: advisory
- 2026-05-11: other: advisory withdrawn as duplicate