Incorrect Authorization

🗓️ 31 Mar 2026 23:53:00Reported by Snyk Security DatabaseType

Incorrect Authorization in openclaw Feishu extension exposes arbitrary files; upgrade to 2026.3.28-beta.1.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2026-41363	27 Apr 202623:24	–	attackerkb
CNNVD	OpenClaw 路径遍历漏洞	28 Apr 202600:00	–	cnnvd
CNVD	OpenClaw path traversal vulnerability (CNVD-2026-19027)	28 Apr 202600:00	–	cnvd
CVE	CVE-2026-41363	27 Apr 202623:24	–	cve
Cvelist	CVE-2026-41363 OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter	27 Apr 202623:24	–	cvelist
EUVD	EUVD-2026-25943	27 Apr 202623:24	–	euvd
Github Security Blog	OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image	31 Mar 202623:53	–	github
Github Security Blog	Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image	28 Apr 202600:31	–	github
NVD	CVE-2026-41363	28 Apr 202600:16	–	nvd
OSV	GHSA-QF48-QFV4-JJM9 OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image	31 Mar 202623:53	–	osv

Vulners

Node

openclaw openclawRange2026.2.6–2026.3.28-beta.1

Source	Link
cwe	www.cwe.mitre.org/data/definitions/CWE-863.html
cwe	www.cwe.mitre.org/data/definitions/CWE-22.html
security	www.security.snyk.io/vuln/SNYK-JS-OPENCLAW-15864879

29 Apr 2026 01:14Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3 - 6.5

CVSS 46

EPSS0.00339

SSVC