OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media sto…
Medium CVSS 6.5
Summary
OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/openclaw/openclaw/commit/68ceaf7a5f64a23e78b95eff055e4b497218312a Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-v2v2-f783-358j Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-unauthorized-media-download-via-zalo-channel Third Party Advisory
Timeline
- nvd_ingest NVD