PT-2026-37022 · Openclaw · Openclaw

Anshumanbh · CVE-2026-43567 · Published 2026-04-17 · Updated 2026-05-05

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description A path traversal issue exists in the screen record tool where the outPath parameter bypasses workspace-only filesystem guards. This allows an authorized tool call to write files to unintended locations on the system by specifying a path outside the intended workspace boundary.

Recommendations Update to version 2026.4.10 or newer.

Exploit

Fix

Missing Authorization

Path traversal

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-22

CWE-863

Related Identifiers

CVE-2026-43567

GHSA-JF25-7968-H2H5

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43567.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-jf25-7968-h2h5 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/635bb35b68d8faa5bfa2fda35feadd315122748a · Patch
• https://osv.dev/vulnerability/CVE-2026-43567 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jf25-7968-h2h5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43567 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/63551 · Note
• https://t.me/CVEtracker/52737 · Telegram Post
• https://vulncheck.com/advisories/openclaw-path-traversal-in-screen-record-outpath-parameter · Note