mediumCVSS 8.6Vulnerability
GHSA-qvmw-h675-h7qg
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2hh7-c75g-qj2r. This link is maintained to preserve external references. ### Original Description OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthorized access to internal resources.
Properties
- ghsa_id
- GHSA-qvmw-h675-h7qg
- severity
- medium
- summary
- Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard
- cvss_score
- 8.6
- cve_id
- GHSA-qvmw-h675-h7qg
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- is_ghsa_only
- true
- ghsa_published
- 2026-05-06T21:31:42Z
- source_url
- https://github.com/advisories/GHSA-qvmw-h675-h7qg
- ghsa_updated
- 2026-05-11T16:13:38Z
Related Entities (4)
AFFECTS (1)
→[Software]npm/OpenClaw
VULNERABLE_TO (1)
←[Software]npm/OpenClaw
HAS_WEAKNESS (1)
→[Weakness]Server-Side Request Forgery (SSRF)
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph