CVE-2026-86538

Received Received - Intake

Path Traversal in OpenClaw Feishu Extension

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-86538

EUVD

EUVD-2026-72556

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in versions before 0.30.0 of a software. It allows unauthenticated attackers to read arbitrary files by exploiting the POST /api/templates/preview endpoint. Attackers manipulate the templateFile parameter with directory traversal sequences to bypass path restrictions and access sensitive files like credentials and configuration through the JSON response.

Detection Guidance

To detect this vulnerability, check if your system is running a version of the software before 0.30.0. You can test for the vulnerability by sending a crafted request to the /api/templates/preview endpoint with a templateFile parameter containing directory traversal sequences like '../' to attempt reading sensitive files. Example: curl -X POST http://target/api/templates/preview -H 'Content-Type: application/json' -d '{"templateFile":"../../../../etc/passwd"}'

If the server responds with the contents of the file, the system is vulnerable.

Impact Analysis

Unauthenticated attackers could exploit this to read sensitive files on your system, including credentials and configuration files. This could lead to unauthorized access, data breaches, or further compromise of your environment. The impact depends on what files are accessible and their sensitivity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties, fines, or reputational damage depending on the data exposed.

Mitigation Strategies

Immediately upgrade the affected software to version 0.30.0 or later to patch the path traversal vulnerability.

If upgrading is not immediately possible, restrict access to the /api/templates/preview endpoint by implementing network-level controls or disabling it temporarily.

Review server logs for suspicious requests containing directory traversal sequences like '../' to identify potential exploitation attempts.

Hi! I’m here to help you understand CVE-2026-86538. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70