N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-846p-hgpv-vphc

GHSA-846p-hgpv-vphc: OpenClaw: QQ Bot structured payloads could read arbitrary local files

Summary

Before OpenClaw 2026.4.2, QQ Bot structured media payloads could read local files from attacker-chosen paths. A crafted structured payload could escape QQ Bot-owned media roots and cause arbitrary file reads on the host.

Impact

Prompt-influenced structured payload output could exfiltrate any host file readable by the OpenClaw process through the QQ Bot media-send path. This was a real confidentiality bug on the host filesystem boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

2c45b06afdd6f7c621038b5419d8e661cff34a7f — restrict QQ Bot structured payload local paths

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-846p-hgpv-vphc

GHSA-846p-hgpv-vphc:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how OpenClaw's QQ Bot extension handles structured media payloads that reference local files. The functions handleImagePayload, handleVideoPayload, and handleFilePayload in extensions/qqbot/src/reply-dispatcher.ts were responsible for processing these payloads.

Before the patch, these functions used the resolveQQBotLocalMediaPath utility to resolve the file path provided in the payload. This utility did not adequately restrict the path to the intended media directory. As a result, a malicious user could craft a payload with a path that used directory traversal sequences (e.g., ../../..) to point to arbitrary files on the host filesystem.

The vulnerable functions would then proceed to read the file at this attacker-controlled path using readFileAsync, exfiltrating its contents. The fix, introduced in commit 2c45b06afdd6f7c621038b5419d8e661cff34a7f, replaces the insecure path resolution with a new function, resolveQQBotPayloadLocalFilePath. This new function canonicalizes the path and strictly ensures it is within the designated QQ Bot media storage directory before allowing it to be used, thus mitigating the path traversal vulnerability. The main dispatcher, handleStructuredPayload, would be the initial function called in an exploit stack trace.

Vulnerable functions

handleImagePayload

extensions/qqbot/src/reply-dispatcher.ts

The function `handleImagePayload` was vulnerable to path traversal. It used `resolveQQBotLocalMediaPath` to get a local file path from a user-controlled payload. This path was not properly sanitized, allowing an attacker to specify a path that traverses outside the intended media directory, leading to arbitrary file reads on the host system when `readFileAsync` was called.

handleVideoPayload

extensions/qqbot/src/reply-dispatcher.ts

The function `handleVideoPayload` was vulnerable to path traversal. It used `resolveQQBotLocalMediaPath` to get a local file path from a user-controlled payload. This path was not properly sanitized, allowing an attacker to specify a path that traverses outside the intended media directory, leading to arbitrary file reads on the host system when `readFileAsync` was called.

handleFilePayload

extensions/qqbot/src/reply-dispatcher.ts

The function `handleFilePayload` was vulnerable to path traversal. It used `resolveQQBotLocalMediaPath` to get a local file path from a user-controlled payload. This path was not properly sanitized, allowing an attacker to specify a path that traverses outside the intended media directory, leading to arbitrary file reads on the host system when `readFileAsync` was called.

handleStructuredPayload

extensions/qqbot/src/reply-dispatcher.ts

This function is the entry point that receives the structured payload from the user. It parses the payload and, based on the `mediaType`, calls one of the vulnerable handler functions (`handleImagePayload`, `handleVideoPayload`, `handleFilePayload`). An exploit would necessarily pass through this function, making it a key indicator in a runtime profile.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.