https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T13:44:07.779902+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-29611 BREW-openclaw-cli-CVE-2026-29611 — OpenClaw has a LFI in BlueBubbles media path handling 2026-09-30T13:44:07.781544+00:00

Affected: Homebrew: openclaw-cli

### Summary The BlueBubbles extension accepted attacker-controlled local filesystem paths via `mediaPath` and could read arbitrary local files from disk before sending them as media attachments.

### Details When `sendBlueBubblesMedia` received a non-HTTP media source, the previous implementation resolved it to a local path and read it directly from disk. There was no required allowlist of safe directories, so values like `/etc/passwd` (or equivalent sensitive paths on other platforms) could be requested and exfiltrated.

The fix hardens local media loading by requiring explicit configured roots (`channels.bluebubbles.mediaLocalRoots`) and by enforcing canonical-path containment checks before reading local files. Paths outside allowed roots are rejected.

Fix PR: https://github.com/openclaw/openclaw/pull/16322 Fix commit: https://github.com/openclaw/openclaw/commit/71f357d9498cebb0efe016b0496d5fbe807539fc

### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `< v2026.2.14` - Fixed: `>= v2026.2.14` (planned)

### Impact An attacker able to trigger BlueBubbles media sends could exfiltrate local files accessible to the OpenClaw process.

### Remediation Upgrade to a release that includes commit `71f357d9498cebb0efe016b0496d5fbe807539fc` and configure `channels.bluebubbles.mediaLocalRoots` to explicit trusted directories.

 https://db.gcve.eu/vuln/cve-2026-29611 CVE-2026-29611 — OpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handling 2026-09-30T13:44:07.781625+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that allows attackers to read arbitrary files from the local filesystem. The sendBlueBubblesMedia function fails to validate mediaPath parameters against an allowlist, enabling attackers to request sensitive files like /etc/passwd and exfiltrate them as media attachments.