N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5fc7-f62m-8983

GHSA-5fc7-f62m-8983: OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

Impact

Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix).

Feishu document uploads could read local files outside the workspace-only file policy when processing docx upload blocks.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <=2026.4.3
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @Rosayxy for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5fc7-f62m-8983

GHSA-5fc7-f62m-8983:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.8	2026.4.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows bypassing a workspace-only filesystem policy during the processing of Feishu docx uploads. This is identified as an incomplete fix for a previous SSRF vulnerability (GHSA-qf48-qfv4-jjm9). The provided patch commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 modifies the fetchWithSsrFGuard function in src/infra/net/fetch-guard.ts.

Analysis of the patch reveals a Time-of-check, time-of-use (TOCTOU) vulnerability in the fetchWithSsrFGuard function. In the vulnerable version, the code first resolves the requested hostname and validates it against a security policy (resolvePinnedHostnameWithPolicy). However, if the system is configured to use a trusted environment proxy, the result of this validation is discarded. The original, unvalidated hostname is passed to the proxy, which then performs its own DNS resolution.

An attacker could exploit this by providing a URL in a docx file that points to a domain they control. At the time of the initial check by fetchWithSsrFGuard, the domain resolves to a safe, public IP address. Immediately after the check, the attacker can change the DNS record to point to a local or internal IP address (e.g., 127.0.0.1). The proxy, resolving the hostname after the check, would then connect to the malicious local IP, bypassing the SSRF protection and allowing access to local files, thus violating the 'Workspace-Only Filesystem Policy'.

The vulnerable function is fetchWithSsrFGuard because it contains the flawed logic that allows the SSRF bypass. The fix addresses this by skipping the initial DNS pinning check when a trusted proxy is in use, correctly delegating the responsibility of safe resolution to the proxy.

Vulnerable functions

fetchWithSsrFGuard

src/infra/net/fetch-guard.ts

The function `fetchWithSsrFGuard` was vulnerable to a Time-of-check, time-of-use (TOCTOU) bypass of its SSRF protection. In the vulnerable version, the function would resolve a hostname and check it against a security policy (`resolvePinnedHostnameWithPolicy`). However, if a trusted proxy was configured, it would then send the original hostname to the proxy, discarding the validated IP address. An attacker could exploit this by having a DNS record point to an allowed IP during the check, and then quickly changing it to a forbidden local or internal IP before the proxy resolved it. This could be triggered by uploading a specially crafted docx file with external resource URLs, leading to local file disclosure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.