A path traversal vulnerability in OpenClaw allows an unauthenticated remote attacker to write arbitrary files to the filesystem, posing a significant risk of system compromise.

The application is susceptible to a path traversal vulnerability (CWE-22) within the Feishu media download process, specifically in extensions/feishu/src/media.ts, where untrusted media keys are interpolated into file paths without sufficient validation. This flaw allows an unauthenticated attacker to escape the intended temporary directory and write files to arbitrary locations on the host server.

The ability to write arbitrary files to the server can lead to full system compromise, including the potential for remote code execution if an attacker overwrites sensitive configuration files or places malicious scripts in accessible directories. With a CVSS score of 8.2, this vulnerability represents a high risk to business operations, potentially resulting in unauthorized data access, service disruption, and long-term persistence for an attacker.

Immediate Action: Upgrade the OpenClaw package to version 2026.2.19 or later to incorporate the necessary input validation fixes.

Proactive Monitoring: Monitor filesystem activity for unexpected file creation or modifications, particularly within directories outside of the designated temporary storage path.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion detection system configured to inspect and block incoming requests containing directory traversal sequences, such as "../", within the Feishu media download parameters.

Public Exploit Available: No (exploit_available: unknown)

Given the high severity of this vulnerability and the potential for remote file writes, administrators should prioritize updating to version 2026.2.19 immediately. Failure to patch this flaw leaves the underlying system exposed to unauthorized file manipulation and potential total system takeover.