Search: CVE-2026-41911

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Low	2.1	EPSS 0.3%	CVE-2026-41911OpenClaw · Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix) Low2.1EPSS 0.3%2026-08-13GCVE DatabaseCVE-2026-41911 A vulnerability in the openclaw npm package (versions >=2026.1.29 and <2026.4.8) allows Feishu document uploads to bypass the workspace-only filesystem policy. This enables reading of local files outside the intended restricted workspace boundary when processing docx upload blocks. The issue affects the OpenClaw local assistant under its trust model and does not assume multi-tenant service boundaries. The vulnerability has been patched in version 2026.4.8. EPSS 0.3%Vulnerability #brew-openclaw-cli-cve-2026-41911 #homebrew	GCVE Database	2026-08-13

Page 1 of 1