CVE-2026-100549

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100549
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100549.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100549
Aliases
  • GHSA-rm45-4jx5-2927
Published
2026-09-26T02:18:45Z
Modified
2026-09-26T11:47:28Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
Details

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended staging directory to other process-writable locations.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100549.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea806575e6450e4d1efdfc72c19f04be982a1b9b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
release-publish/08987d8f409b-20260717
release-publish/0e9db600595-20260717
release-publish/0e9db6005954-20260717
release-publish/0f7fbfa0039f-20260715
release-publish/10a390ed7fa8-20260802
release-publish/17a1225314cd-1787924262
release-publish/1c80cf86cfd0-1787823217
release-publish/1d2777548d01-20260715
release-publish/2133a924eef0-1787945469
release-publish/21b41efc7bb8-1787818100
release-publish/23d2f664fb75-20260715
release-publish/38fd9ad6e417-1787824804
release-publish/404719374e60-1787933925
release-publish/4074a8b44d89-1787849600
release-publish/45ed68e6ea62-1787220256
release-publish/468054f93c43-1787921799
release-publish/491769bded58-1787929537
release-publish/5090935817e3-1787842724
release-publish/54f70c5d8c04-20260715
release-publish/556a2ee276f0-20260718
release-publish/57fabb2c9c35-1786621048
release-publish/5cb2eee257bc-1787929587
release-publish/5cb2eee257bc-1787929714
release-publish/5dca33a8fb67-20260802
release-publish/62c77b0fb51c-1787927225
release-publish/6ddb9f049fb3-1787938179
release-publish/716f996be8db-1786550775
release-publish/728084497329-20260801
release-publish/73d04395defe-20260717
release-publish/7c9794b5c65c-20260801
release-publish/8371831eba5e-1786610071
release-publish/8858944a81c5-20260717
release-publish/8afa8f339eb6-1787798436
release-publish/9b80f9a8b1df-20260717
release-publish/9bc3c2955500-20260802
release-publish/a33c8a5c0ec6-1787896022
release-publish/a84a915b67bd-1787933964
release-publish/a9ac13b2efd7-20260717
release-publish/abd63c06c2f5-1786646045
release-publish/b3986403ddb9-1787938102
release-publish/bb1a7e506927-20260715
release-publish/bccb649077f0-1787900300
release-publish/c28c279afa37-1787225611
release-publish/c3927271fad7-20260715
release-publish/c96e81375014-1787462685
release-publish/ced50f88e928-20260717
release-publish/d5412d73acfb-1787906286
release-publish/d8b3e1c093f2-20260715
release-publish/d8dd59bf8f60-20260717
release-publish/deffca656500-20260801
release-publish/dfa246e6fd16-20260715
release-publish/e11c566824b1-1787940135
release-publish/eb8c22ed13f9-20260801
release-publish/ebc70fa1b3f6-1787634336
release-publish/f4987deb94b8-1786361493
release-publish/f4f5bb15d46a-20260715
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v1.*
v1.0.4
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v2.*
v2.0.0-beta1
v2.0.0-beta2
v2.0.0-beta3
v2.0.0-beta4
v2.0.0-beta5
v2026.*
v2026.1.10
v2026.1.11
v2026.1.11-1
v2026.1.11-2
v2026.1.11-3
v2026.1.12
v2026.1.12-2
v2026.1.13
v2026.1.14-1
v2026.1.15
v2026.1.16-2
v2026.1.20
v2026.1.21
v2026.1.22
v2026.1.23
v2026.1.24
v2026.1.24-1
v2026.1.29
v2026.1.30
v2026.1.5
v2026.1.5-1
v2026.1.5-2
v2026.1.5-3
v2026.1.8
v2026.1.9
v2026.2.1
v2026.2.12
v2026.2.13
v2026.2.14
v2026.2.15-beta.1
v2026.2.17
v2026.2.19
v2026.2.19-beta.1
v2026.2.2
v2026.2.21
v2026.2.21-beta.1
v2026.2.22
v2026.2.22-beta.1
v2026.2.23
v2026.2.23-beta.1
v2026.2.24
v2026.2.24-beta.1
v2026.2.25
v2026.2.25-beta.1
v2026.2.26
v2026.2.26-beta.1
v2026.2.3
v2026.2.6
v2026.2.6-1
v2026.2.6-2
v2026.2.6-3
v2026.2.9
v2026.3.1
v2026.3.11
v2026.3.11-beta.1
v2026.3.12
v2026.3.13
v2026.3.13-1
v2026.3.2
v2026.3.2-beta.1
v2026.3.22
v2026.3.22-beta.1
v2026.3.23
v2026.3.23-2
v2026.3.23-beta.1
v2026.3.24
v2026.3.24-beta.1
v2026.3.24-beta.2
v2026.3.28
v2026.3.28-beta.1
v2026.3.31
v2026.3.31-beta.1
v2026.3.7
v2026.3.7-beta.1
v2026.3.8
v2026.3.8-beta.1
v2026.4.1
v2026.4.1-beta.1
v2026.4.10
v2026.4.11
v2026.4.11-beta.1
v2026.4.12
v2026.4.12-beta.1
v2026.4.14
v2026.4.14-beta.1
v2026.4.15
v2026.4.15-beta.1
v2026.4.15-beta.2
v2026.4.19-beta.1
v2026.4.19-beta.2
v2026.4.2
v2026.4.5
v2026.4.7
v2026.4.7-1
v2026.4.8
v2026.4.9
v2026.4.9-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100549.json"