CVE-2026-100549: OpenClaw Path Traversal Vulnerability

CVE-2026-100549 Overview

CVE-2026-100549 is a path traversal vulnerability [CWE-22] in OpenClaw versions before 2026.8.1. The flaw exists in the QQBot voice attachment handling code, where filenames are decoded twice. Encoded traversal sequences such as %252e%252e%252f survive the first sanitization pass and resurface as ../ after the second decode. Attackers with low privileges can supply crafted voice attachments to write files outside the staging directory into any location writable by the OpenClaw process.

Critical Impact
Authenticated attackers can write arbitrary files to process-writable paths, enabling configuration tampering, log poisoning, or persistence on affected OpenClaw deployments.

Affected Products

OpenClaw versions prior to 2026.8.1
OpenClaw QQBot voice attachment handler component
Deployments exposing the QQBot interface to untrusted input

Discovery Timeline

2026-09-26 - CVE-2026-100549 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100549

Vulnerability Analysis

The vulnerability occurs in the OpenClaw QQBot voice attachment pipeline. Incoming filenames are URL-decoded, sanitized against path traversal sequences, and then decoded again before use. The second decode reintroduces traversal segments that the sanitizer already removed. An attacker who submits a double-encoded filename bypasses the filter entirely.

This is a classic double-decoding flaw mapped to [CWE-22]. Exploitation requires low-privileged access to the bot interface and no user interaction. The resulting write primitive is constrained to directories writable by the OpenClaw process, limiting direct impact on operating system integrity.

Root Cause

The root cause is improper ordering of decoding and sanitization. The filename handler calls a URL decode routine, applies traversal filtering, then performs a second decode when staging the file to disk. Payloads such as ..%252f..%252fetc%252fconfig pass filtering as ..%2f..%2fetc%2fconfig and resolve to ../../etc/config on write.

Attack Vector

The attack vector is network-based through the QQBot interface. An attacker with permission to send voice messages crafts an attachment whose filename contains double-URL-encoded traversal segments. When OpenClaw processes the attachment, the decoded path escapes the staging directory. The attacker can overwrite application configuration files, drop files into log directories, or stage artifacts for later execution by other components. See the GitHub Security Advisory and the VulnCheck Advisory on Path Traversal for technical details.

Detection Methods for CVE-2026-100549

Indicators of Compromise

Voice attachment filenames containing double-encoded sequences such as %252e%252e%252f, %252f, or %255c
Files written outside the QQBot voice staging directory with timestamps matching bot activity
Unexpected modifications to OpenClaw configuration, plugin, or log directories
QQBot request logs showing attachment filenames with percent-encoded %25 prefixes

Detection Strategies

Inspect QQBot request logs for filenames containing %25 followed by hexadecimal pairs that resolve to . or / characters
Compare canonicalized file write paths against the configured staging directory and alert on any deviation
Enable file integrity monitoring on OpenClaw configuration, plugin, and runtime directories

Monitoring Recommendations

Log all filename inputs to the QQBot voice handler before and after each decode operation
Alert on process writes by the OpenClaw service account to paths outside its designated data directory
Correlate inbound QQBot attachment events with subsequent filesystem write activity for anomaly detection

How to Mitigate CVE-2026-100549

Immediate Actions Required

Upgrade OpenClaw to version 2026.8.1 or later, which resolves the double-decode flaw
Restrict QQBot access to trusted users and remove accounts that do not require voice attachment permissions
Audit the OpenClaw staging and configuration directories for unexpected files created before the upgrade

Patch Information

OpenClaw version 2026.8.1 contains the fix. Review the GitHub Security Advisory GHSA-rm45-4jx5-2927 for upgrade guidance and the full list of changes.

Workarounds

Place a reverse proxy or input filter in front of the QQBot endpoint to reject attachment filenames containing %25 sequences
Run the OpenClaw process under a dedicated low-privilege account with write access limited to the staging directory
Apply mandatory access controls such as AppArmor or SELinux to confine writes to approved paths

bash

# Configuration example: restrict OpenClaw writable paths via systemd
[Service]
User=openclaw
ReadWritePaths=/var/lib/openclaw/staging
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true