CVE-2026-29611

描述

### Summary The BlueBubbles extension accepted attacker-controlled local filesystem paths via `mediaPath` and could read arbitrary local files from disk before sending them as media attachments. ### Details When `sendBlueBubblesMedia` received a non-HTTP media source, the previous implementation resolved it to a local path and read it directly from disk. There was no required allowlist of safe directories, so values like `/etc/passwd` (or equivalent sensitive paths on other platforms) could be requested and exfiltrated. The fix hardens local media loading by requiring explicit configured roots (`channels.bluebubbles.mediaLocalRoots`) and by enforcing canonical-path containment checks before reading local files. Paths outside allowed roots are rejected. Fix PR: https://github.com/openclaw/openclaw/pull/16322 Fix commit: https://github.com/openclaw/openclaw/commit/71f357d9498cebb0efe016b0496d5fbe807539fc ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `< v2026.2.14` - Fixed: `>= v2026.2.14` (planned) ### Impact An attacker able to trigger BlueBubbles media sends could exfiltrate local files accessible to the OpenClaw process. ### Remediation Upgrade to a release that includes commit `71f357d9498cebb0efe016b0496d5fbe807539fc` and configure `channels.bluebubbles.mediaLocalRoots` to explicit trusted directories.

如何修補 CVE-2026-29611

要修補 CVE-2026-29611,請將受影響套件升級到下列已修補版本。

• —升級至 2026.2.14 或更新版本

CVE-2026-29611 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 2026.2.14

CVSS 分數