CVE-2026-100549

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1

Description An issue exists in the QQBot voice attachment handling where filenames are decoded twice. This double decoding allows encoded traversal segments to reappear after the sanitization process, enabling a path traversal attack. An attacker can provide specially crafted voice attachments to write files outside the intended staging directory into other locations writable by the process.

Recommendations Update to version 2026.8.1.