8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qvmw-h675-h7qg

GHSA-qvmw-h675-h7qg: Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2hh7-c75g-qj2r. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthorized access to internal resources.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qvmw-h675-h7qg

GHSA-qvmw-h675-h7qg:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.22	2026.4.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the Zalo plugin of OpenClaw, specifically within the photo sending functionality. The root cause is the lack of validation on the photo URL provided when sending a photo. The primary vulnerable function is sendPhoto in extensions/zalo/src/api.ts. Before the patch, this function would take a URL and pass it to callZaloApi without checking if the URL pointed to an internal or restricted resource. An attacker could craft a request with a malicious photo URL to make the server send requests to internal services.

The patch addresses this by adding several layers of validation within the sendPhoto function:

It ensures the provided string is a valid URL.
It checks that the URL protocol is either http or https.
Most importantly, it uses resolvePinnedHostnameWithPolicy to check the URL's hostname against a defined SSRF policy, preventing requests to private or internal IP addresses.

The function sendPhotoZalo in extensions/zalo/src/send.ts is also identified as a vulnerable function because it is an entry point that directly calls the vulnerable sendPhoto function, passing user-controllable data to it. Any runtime trace of an exploit would likely show sendPhotoZalo calling sendPhoto.

Vulnerable functions

sendPhoto

extensions/zalo/src/api.ts

The `sendPhoto` function in `extensions/zalo/src/api.ts` was vulnerable to Server-Side Request Forgery (SSRF). The original implementation directly passed the `photo` URL from the `params` argument to the `callZaloApi` function without any validation. This allowed an attacker to provide a malicious URL, potentially pointing to internal network resources, which the server would then request. The patch mitigates this by parsing the URL, ensuring it uses HTTP or HTTPS protocols, and then validating the hostname against an SSRF policy using `resolvePinnedHostnameWithPolicy` before making the request.

sendPhotoZalo

extensions/zalo/src/send.ts

The `sendPhotoZalo` function in `extensions/zalo/src/send.ts` is an exported function that acts as a wrapper for the vulnerable `sendPhoto` function. It constructs the parameters for `sendPhoto` and calls it, thus exposing the SSRF vulnerability. An attacker could exploit this function to trigger the vulnerability in `sendPhoto`. The change in the patch to an async IIFE does not alter the fact that it calls the now-patched `sendPhoto` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.