PT-2026-23557 · Openclaw · Openclaw

Akhmittra · Published 2026-02-14 · Updated 2026-03-06 · CVE-2026-28482

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.12

Description OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences, such as ../../etc/passwd in the sessionId or sessionFile parameters, to read or write arbitrary files outside the agent sessions directory. An attacker must be authenticated to the gateway to exploit this issue. The gateway, by default, binds to loopback, so configurations exposing the gateway widen the attack surface. The issue is related to transcript file read/write operations.

Recommendations Upgrade to OpenClaw version 2026.2.12 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-06351

CVE-2026-28482

GHSA-5XFQ-5MR7-426Q

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/commit/4199f9889f0c307b77096a229b9e085b8d856c26 · Patch
• https://github.com/openclaw/openclaw/commit/cab0abf52ac91e12ea7a0cf04fff315cf0c94d64 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5xfq-5mr7-426q · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06351 · Security Note
• https://osv.dev/vulnerability/GHSA-5xfq-5mr7-426q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28482 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28482 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.12 · Note
• https://vulncheck.com/advisories/openclaw-path-traversal-via-unsanitized-sessionid-and-sessionfile-parameters · Note
• https://t.me/CVEtracker/46501 · Telegram Post