What is GHSA-hj9p-9244-xg6j?

GHSA-hj9p-9244-xg6j is a security advisory published by GitHub Security Advisories with Medium severity. OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice...

Which CVE IDs does GHSA-hj9p-9244-xg6j cover?

GHSA-hj9p-9244-xg6j covers the following CVE IDs: CVE-2026-100549. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hj9p-9244-xg6j?

GHSA-hj9p-9244-xg6j has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-hj9p-9244-xg6jMediumCVSS 5.4

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-100549 →

📋 Description

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended staging directory to other process-writable locations.

🔗 References (4)

https://github.com/openclaw/openclaw/security/advisories/GHSA-rm45-4jx5-2927
https://nvd.nist.gov/vuln/detail/CVE-2026-100549
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-path-traversal-via-qqbot-voice-filenames
https://github.com/advisories/GHSA-hj9p-9244-xg6j