PT-2026-22493 · Npm · Openclaw

Publicado 2026-02-18 · Atualizado 2026-02-18

OSV

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently constraining writes to OpenClaw-managed temporary directories.

Impact

If an attacker can access the browser control API, they could attempt to write trace/download output files outside intended temp roots, depending on process filesystem permissions.

Affected versions

openclaw < 2026.2.13

Fixed versions

openclaw >= 2026.2.13

Remediation

Upgrade to 2026.2.13 or later.

What changed

The fix constrains output paths for:

• POST /trace/stop
• POST /wait/download
• POST /download

All three now enforce OpenClaw temp-root boundaries and reject traversal/escape paths.

Credits

Thanks to Adnan Jakati (@jackhax) of Praetorian for responsible disclosure.

Fix shipped in PR #15652 and merged to main on February 13, 2026 (7f0489e4731c8d965d78d6eac4a60312e46a9426).

---

Fix commit 7f0489e4731c8d965d78d6eac4a60312e46a9426 confirmed on main and in v2026.2.14. Upgrade to openclaw >= 2026.2.13.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-GQ9C-WG68-GWJ2

Produtos afetados

Openclaw

Referências · 7

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gq9c-wg68-gwj2 · Nota
• https://github.com/openclaw/openclaw/commit/7f0489e4731c8d965d78d6eac4a60312e46a9426 · Nota
• https://github.com/openclaw/openclaw/pull/15652 · Nota
• https://vulncheck.com/advisories/openclaw-path-traversal-in-trace-and-download-output-paths · Nota
• https://osv.dev/vulnerability/GHSA-gq9c-wg68-gwj2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28462 · Nota de Segurança