OpenClaw versions before 2026.8.1 have a path traversal flaw in handling QQBot voice attachments. Filenames are decoded twice, which allows encoded traversal sequences to survive sanitization. An attacker can craft a voice attachment that writes files outside the intended staging directory, potentially creating or overwriting files in other process‑writable locations. This could enable partial code execution, data tampering, or unauthorized persistence by placing malicious files in privileged directories.

The affected product is OpenClaw, specifically all releases prior to version 2026.8.1. No other vendors or products are listed. Users should verify whether their deployments use a vulnerable version and consider upgrading.

The CVSS score is 5.3, indicating a medium severity vulnerability. The EPSS score is unavailable, so exploitation probability cannot be quantified, and it is not listed in the CISA KEV catalog. Attackers would need to deliver a crafted QQBot voice attachment, which can be accomplished over the network if the service accepts user-supplied attachments. The exploitation does not require elevated privileges beyond the normal operation of the application, so remote attackers can potentially create or overwrite files in writable directories, leading to further compromise.