Untriaged
Permalink
CVE-2026-28462
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths
OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST /trace/stop, POST /wait/download, and POST /download endpoints to write files outside intended temp roots.
References
-
GitHub Security Advisory (GHSA-gq9c-wg68-gwj2) vendor-advisory
-
Patch Commit patch
Affected products
OpenClaw
- <2026.2.13
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>