PT-2026-23537

CVE-2026-28462

Published

2026-02-18

Updated

2026-03-07

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.13

Description The browser control API in OpenClaw accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in the following API endpoints to write files outside intended temp roots: /trace/stop, /wait/download, and /download. The POST method is used for these endpoints. The vulnerable parameters or variables are not explicitly mentioned.

Recommendations Upgrade to version 2026.2.13 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Adnan Jakati

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers