CVE-2026-26972 MEDIUM

CVE-2026-26972: OpenClaw has a Path Traversal in Browser Download Functionality

Vendor Openclaw
Product openclaw
Weakness CWE-22 · Path traversal
Published February 19, 2026
Last update February 20, 2026
View on NVD All CVEs

CVSS base score

6.7/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized output path. When invoked via the browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory. This issue is not exposed via the AI agent tool schema (no `download` action). Exploitation requires authenticated CLI access or an authenticated gateway RPC token. Version 2026.2.13 fixes the issue.

Key dates

02Disclosure timeline

February 19, 2026 CVE published
February 20, 2026 Record updated