AI agent vulnerability · OpenClaw

CVE-2026-26972: OpenClaw has a Path Traversal in Browser Download Functionality

mediumCVSS 3.1 6.7GHSA-xwjm-j929-xq7c

Summary OpenClaw browser download helpers accepted an unsanitized output path. When invoked via the browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory. This issue is not exposed via the AI agent tool schema (no download action). Exploitation requires authenticated CLI access or an authenticated gateway RPC token.

Published Feb 18, 2026 · Updated Feb 20, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: >= 2026.1.12, <= 2026.2.12
Fixed in: 2026.2.13
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

OpenClaw browser download helpers accepted an unsanitized output path. When invoked via the browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory.

This issue is not exposed via the AI agent tool schema (no download action). Exploitation requires authenticated CLI access or an authenticated gateway RPC token.

Affected Packages / Versions

Package: openclaw (npm)
Affected: >=2026.1.12, <=2026.2.12
Fixed: >=2026.2.13

Details

Affected code: src/browser/pw-tools-core.downloads.ts (waitForDownloadViaPlaywright, downloadViaPlaywright).

Fixed entrypoints (as of 2026.2.13):

Gateway browser control routes /wait/download and /download now restrict path to DEFAULT_DOWNLOAD_DIR via resolvePathWithinRoot.

Fix Commit(s)

7f0489e4731c8d965d78d6eac4a60312e46a9426

Mitigation

Upgrade to openclaw >=2026.2.13.

Thanks @locus-x64 for reporting.

Credited to locus-x64.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries