GHSA-xwjm-j929-xq7c: OpenClaw has a Path Traversal in Browser Download Functionality
Summary
OpenClaw, a browser download tool, had a path traversal vulnerability (a security flaw where an attacker could use special characters like `../` to write files outside the intended folder) in its download feature because it didn't validate the output file path. This vulnerability only affected users with authenticated access to the CLI or gateway RPC token (a special permission token), not regular AI agent users.
Solution / Mitigation
Upgrade to `openclaw` version 2026.2.13 or later. The fix restricts the `path` parameter to the default download directory using `resolvePathWithinRoot` in the gateway browser control routes `/wait/download` and `/download`.
Vulnerability Details
EPSS: 0.0%
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2022-21727: Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulne
CVE-2026-22252: LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbi
Original source: https://github.com/advisories/GHSA-xwjm-j929-xq7c
First tracked: February 18, 2026 at 03:00 PM
Classified by LLM (prompt v3) · confidence: 75%