CVE-2026-28482: Path Traversal in OpenClaw

The core of this vulnerability lies in OpenClaw's handling of sessionId and sessionFile parameters when constructing transcript file paths. The application fails to properly sanitize these parameters, allowing attackers to inject path traversal sequences like ../../etc/passwd. Successful exploitation enables an attacker, after authentication, to read arbitrary files outside the designated agent sessions directory. This could include sensitive configuration files, user data, or even system files, depending on the permissions of the OpenClaw process. The potential for data exfiltration and system compromise is significant, particularly in environments where OpenClaw is used to manage sensitive information or interact with critical infrastructure.

1. Reserved2026-02-27
2. Published2026-03-05
3. Modified2026-03-09
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-28482 is to immediately upgrade OpenClaw to version 2026.2.12 or later. If an immediate upgrade is not feasible due to compatibility concerns or system downtime constraints, consider implementing stricter directory access controls for the OpenClaw agent sessions directory. This could involve restricting write permissions to only the OpenClaw process and its designated user. While not a complete solution, this can limit the attacker's ability to write arbitrary files. Further, review and harden authentication mechanisms to prevent unauthorized access to the OpenClaw system. After upgrading, confirm the fix by attempting a path traversal attack with a known malicious payload (e.g., ../../etc/passwd) and verifying that access is denied.