CVE-2026-41911: OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

April 9, 2026 (updated April 28, 2026)

Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix).

Feishu document uploads could read local files outside the workspace-only file policy when processing docx upload blocks.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

References

github.com/advisories/GHSA-5fc7-f62m-8983
github.com/openclaw/openclaw/security/advisories/GHSA-5fc7-f62m-8983
nvd.nist.gov/vuln/detail/CVE-2026-41911

Code Behaviors & Features

Detect and mitigate CVE-2026-41911 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →