8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43533

CVE-2026-43533: OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text containing media tags to disclose arbitrary local files through outbound media handling.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43533

CVE-2026-43533:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.10	2026.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in the QQBot integration of OpenClaw, allowing an attacker to read arbitrary local files. The root cause is the lack of proper validation on file paths provided in media tags for outbound messages. The patch addresses this by introducing a new function, resolveOutboundMediaPath, which rigorously checks if a given file path is within the allowed media storage directories. This new function replaces the previous, insecure resolveQQBotLocalMediaPath function. The vulnerable functions, sendPhoto, sendVoice, sendVideoMsg, sendDocument, and sendMedia, all processed user-supplied paths for media content. An attacker could craft a reply with a malicious media tag pointing to a sensitive file on the host system (e.g., [qq:media]file:///etc/passwd[/qq:media]). When OpenClaw processed this reply to send a message via QQBot, the vulnerable functions would read the specified local file and send it as media. The fix ensures that any local file path is resolved to its real path and checked to be within the QQBot media or data directories, thus preventing the traversal.

Vulnerable functions

sendPhoto

extensions/qqbot/src/outbound.ts

The `sendPhoto` function was vulnerable to path traversal. It previously used `resolveQQBotLocalMediaPath` which did not properly sanitize the `imagePath` parameter. An attacker could provide a crafted path to read arbitrary local files. The patch replaced this with `resolveOutboundMediaPath` which enforces that the path is within the allowed media storage directory.

sendVoice

extensions/qqbot/src/outbound.ts

The `sendVoice` function was vulnerable to path traversal. It used `resolveQQBotLocalMediaPath` on the `voicePath` parameter without proper validation, allowing an attacker to access files outside the intended directory. The fix involves using the new `resolveOutboundMediaPath` function to ensure the path is safe.

sendVideoMsg

extensions/qqbot/src/outbound.ts

The `sendVideoMsg` function was vulnerable to path traversal because it did not properly validate the `videoPath` parameter. It used `resolveQQBotLocalMediaPath`, which was insufficient. An attacker could use this to read arbitrary files. The patch introduced `resolveOutboundMediaPath` to correctly validate the path against the media storage boundary.

sendDocument

extensions/qqbot/src/outbound.ts

The `sendDocument` function was vulnerable to path traversal. The `filePath` parameter was not properly sanitized, allowing an attacker to specify a path to an arbitrary local file. The function previously used `resolveQQBotLocalMediaPath`. The patch now uses `resolveOutboundMediaPath` to enforce path restrictions.

sendMedia

extensions/qqbot/src/outbound.ts

The `sendMedia` function was vulnerable to path traversal through the `ctx.mediaUrl` parameter. It used `resolveQQBotLocalMediaPath` which did not prevent access to files outside the media directory. The patch fixes this by using `resolveOutboundMediaPath` to validate the path.

sendVoiceFromLocal

extensions/qqbot/src/outbound.ts

The internal function `sendVoiceFromLocal` was susceptible to a time-of-check-to-time-of-use (TOCTOU) vulnerability. Even if the initial path check in `sendVoice` passed, a symlink could be introduced before this function was called, leading to a path traversal. The patch adds a re-check of the file path right before it's used to prevent this race condition.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.