PT-2026-23537 · Openclaw · Openclaw

Adnan Jakati · Published 2026-02-18 · Updated 2026-03-07 · CVE-2026-28462

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.13

Description The browser control API in OpenClaw accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in the following API endpoints to write files outside intended temp roots: /trace/stop, /wait/download, and /download. The POST method is used for these endpoints. The vulnerable parameters or variables are not explicitly mentioned.

Recommendations Upgrade to version 2026.2.13 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-28462

GHSA-GQ9C-WG68-GWJ2

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gq9c-wg68-gwj2 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/7f0489e4731c8d965d78d6eac4a60312e46a9426 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28462 · Security Note
• https://osv.dev/vulnerability/GHSA-gq9c-wg68-gwj2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28462 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/15652 · Note
• https://vulncheck.com/advisories/openclaw-path-traversal-in-trace-and-download-output-paths · Note
• https://twitter.com/CVEnew/status/2030385185078890696 · Twitter Post