OpenClaw Path Traversal Vulnerability in Feishu Extension Allowing Arbitrary File Read

A path traversal vulnerability has been identified in OpenClaw versions 2026.2.6 prior to 2026.3.24. The issue resides in the Feishu extension's resolveUploadInput function, where improper path resolution during upload_image operations can bypass file-system sandbox restrictions. This vulnerability allows attackers to read arbitrary files outside the designated localRoots boundaries.

Impact

Exploitation of this vulnerability could lead to unauthorized reading of files from the host system, bypassing workspace or localRoots path restrictions.

Remediation

Users can upgrade to OpenClaw version 2026.3.28 or later, where this vulnerability has been patched.