CVE-2026-100555

The OpenClaw npm-distributed gateway application (versions >= 2026.7.1 and

CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery

OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...

CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery

OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...

CVE-2026-100549 OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended...

CVE-2026-100549 OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended...

EUVD-2026-87501

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended...

CVE-2026-100549

OpenClaw versions before 2026.8.1 are vulnerable to a path traversal vulnerability within the QQBot voice attachment handling component. The root cause is that filenames are decoded twice , which allows encoded traversal segments to reappear after the initial sanitization process. An attacker can...

CVE-2026-100549: Improper Limitation of a Pathname to a Restricted Directory

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended...

CVE-2026-100555: Server-Side Request Forgery (SSRF)

OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...

CVE-2026-100389

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible...

CVE-2026-100389

GestSup versions prior to 3.2.61 are vulnerable to remote code execution (RCE) due to a flaw in the basic IMAP connector's attachment handling. The system fails to skip blocked file extensions, allowing unauthenticated attackers to send emails containing PHP attachments to monitored mailboxes. Th...

CVE-2026-63205

In Zammad versions prior to 7.1.2 , a vulnerability exists where users with specific channel admin permissions can access unauthorized attachments. When creating or updating an email signature, the system processes inline images; if an HTML img tag points to an existing attachment, Zammad copies ...

CVE-2026-63205 Zammad: Channel admins can read unauthorized attachments via signature rich-text body

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies th...

CVE-2026-63205 Zammad: Channel admins can read unauthorized attachments via signature rich-text body

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies th...

CVE-2026-56723

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

CVE-2026-56723 Zammad: Missing authorization on ticket attachment download

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

CVE-2026-56723 Zammad: Missing authorization on ticket attachment download

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

CVE-2026-56723

The Zammad helpdesk and customer support system contains an authorization bypass in versions prior to 7.0.2 . While internal ticket articles are correctly hidden from customers via the article listing API, the attachment download endpoint fails to enforce article-level authorization. This allows ...

CVE-2026-56723 Zammad: Missing authorization on ticket attachment download

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

EUVD-2026-87205

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...