OpenClaw hardened the skill download target directory validation

OpenClaw has a Path Traversal in Browser Download Functionality

OpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawn

OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback

OpenClaw before 2026.7.1 Authorization Bypass via diagnostics

OpenClaw before 2026.7.1 Authorization Bypass via trajectory export

OpenClaw before 2026.8.1 Local File Read via Outbound Attachments

OpenClaw before 2026.8.1 Path Traversal via Structured Attachments

OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation

OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests

OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

OpenClaw < 2026.6.5 Authorization Header Forwarding via SSE

OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install

OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files

OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy

OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency

OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands

OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search

OpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation

OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands

QQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming Command

OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload

OpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwarding

OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope

Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay

OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

OpenClaw < 2026.5.6 - Approval Policy Bypass in Skill Workshop Apply Flow

OpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes

OpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recovery

OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

OpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes

OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists

OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling

OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint

OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter

OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases

OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling

OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation

OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image

OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass

OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling

OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass

OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation

OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints

OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP Dispatch

OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution

OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass

OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter

OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration