CVE-2026-43533CWE-23

OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

High · published May 5, 2026

CVSS v4.0
8.9
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text containing media tags to disclose arbitrary local files through outbound media handling.

The record
Technical detail
CVSS v4.0
8.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00536 · 44.4th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-05-05T11:25Z
EPSS history
Timeline
  • 05 MAY 11:25Z
    OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags
    cvelistv5