OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writesGHSA-gq9c-wg68-gwj2
HIGHFix: openclaw/openclaw#15652GHSA-gq9c-wg68-gwj2 is a high-severity (CVSS 7.5) Path Traversal vulnerability in openclaw. A fix is available for openclaw — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-gq9c-wg68-gwj2.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
openclawnpmDescription
Summary
OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently constraining writes to OpenClaw-managed temporary directories.
Impact
If an attacker can access the browser control API, they could attempt to write trace/download output files outside intended temp roots, depending on process filesystem permissions.
Affected versions
openclaw < 2026.2.13
Fixed versions
openclaw >= 2026.2.13
Remediation
Upgrade to 2026.2.13 or later.
What changed
The fix constrains output paths for:
POST /trace/stopPOST /wait/downloadPOST /download
All three now enforce OpenClaw temp-root boundaries and reject traversal/escape paths.
Credits
Thanks to Adnan Jakati (@jackhax) of Praetorian for responsible disclosure.
Fix shipped in PR #15652 and merged to main on February 13, 2026 (7f0489e4731c8d965d78d6eac4a60312e46a9426).
Fix commit 7f0489e4731c8d965d78d6eac4a60312e46a9426 confirmed on main and in v2026.2.14. Upgrade to openclaw >= 2026.2.13.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | openclaw | all versions | 2026.2.13npm install openclaw@2026.2.13 |
Affected Products
openclawopenclawDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update openclaw to 2026.2.13 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gq9c-wg68-gwj2 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is GHSA-gq9c-wg68-gwj2 in your dependencies?
Find it across npm, including transitive dependencies.