CVE-2026-28462

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-28462
OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST /trace/stop, POST /wait/download, and POST /download endpoints to write files outside intended temp roots.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/7f0489e4731c8d965d78d6eac4a60312e46a9426 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-gq9c-wg68-gwj2 Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-path-traversal-in-trace-and-download-output-paths Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

09 Mar 2026, 17:32

Type Values Removed Values Added
References () https://github.com/openclaw/openclaw/commit/7f0489e4731c8d965d78d6eac4a60312e46a9426 - () https://github.com/openclaw/openclaw/commit/7f0489e4731c8d965d78d6eac4a60312e46a9426 - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-gq9c-wg68-gwj2 - () https://github.com/openclaw/openclaw/security/advisories/GHSA-gq9c-wg68-gwj2 - Vendor Advisory
References () https://www.vulncheck.com/advisories/openclaw-path-traversal-in-trace-and-download-output-paths - () https://www.vulncheck.com/advisories/openclaw-path-traversal-in-trace-and-download-output-paths - Third Party Advisory
First Time Openclaw openclaw
Openclaw
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

09 Mar 2026, 13:36

Type Values Removed Values Added
Summary
  • (es) Las versiones de OpenClaw anteriores a 2026.2.13 contienen una vulnerabilidad en la API de control del navegador en la que acepta rutas de salida proporcionadas por el usuario para archivos de rastreo y descarga sin restringir consistentemente las escrituras a directorios temporales. Atacantes con acceso a la API pueden explotar el salto de ruta en los endpoints POST /trace/stop, POST /wait/download y POST /download para escribir archivos fuera de las raíces temporales previstas.

05 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-05 22:16

Updated : 2026-03-09 17:32

NVD link : CVE-2026-28462

Mitre link : CVE-2026-28462

CVE.ORG link : CVE-2026-28462

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')