PT-2026-37022 · Openclaw · Openclaw

Anshumanbh · Published 2026-04-17 · Updated 2026-05-05 · CVE-2026-43567

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description A path traversal issue exists in the screen record tool where the outPath parameter bypasses workspace-only filesystem guards. This allows an authorized tool call to write files to unintended locations on the system by specifying a path outside the intended workspace boundary.

Recommendations Update to version 2026.4.10 or newer.

Fix

Missing Authorization

Path traversal

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-22

CWE-863

Related Identifiers

CVE-2026-43567

GHSA-JF25-7968-H2H5

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jf25-7968-h2h5 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/635bb35b68d8faa5bfa2fda35feadd315122748a · Patch
• https://osv.dev/vulnerability/GHSA-jf25-7968-h2h5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43567 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/63551 · Note
• https://vulncheck.com/advisories/openclaw-path-traversal-in-screen-record-outpath-parameter · Note
• https://t.me/CVEtracker/52737 · Telegram Post