CVE-2026-26972: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26972 is a path traversal vulnerability (CWE-22) in the OpenClaw browser download helpers that allows authenticated attackers to write files outside the intended temporary downloads directory. It affects the OpenClaw npm package versions 2026.1.12 through 2026.2.12 (inclusive). The vulnerability was published on February 16, 2026, and patched in version 2026.2.13. It carries a CVSS v3.1 base score of 6.7 (Medium) (Github Advisory, OpenClaw Advisory).

The root cause is improper input sanitization (CWE-22) in the browser download helper functions waitForDownloadViaPlaywright and downloadViaPlaywright located in src/browser/pw-tools-core.downloads.ts. When these helpers are invoked via the browser control gateway routes (POST /wait/download and POST /download), the path parameter accepted by the request body was passed directly without validation, enabling path traversal sequences (e.g., ../../pwned.pdf) to resolve file write destinations outside the intended DEFAULT_DOWNLOAD_DIR (/tmp/openclaw/downloads). The same issue affected the POST /trace/stop route for trace output paths. Exploitation requires either authenticated CLI access or a valid authenticated gateway RPC token — it is not reachable through the AI agent tool schema (Github Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to write arbitrary files to any location accessible by the OpenClaw process, including overwriting critical system files or planting executable code. This results in high confidentiality, integrity, and availability impact, potentially enabling full system compromise or persistent unauthorized access. The vulnerability's local attack vector limits its exposure, but an attacker with a valid RPC token could abuse it remotely within the network context where the gateway is accessible (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.014% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for authenticated CLI access or a valid gateway RPC token, significantly limiting the attacker pool (Github Advisory).

1. Obtain authentication: Acquire authenticated CLI access to the OpenClaw instance or obtain a valid gateway RPC token with sufficient privileges to invoke browser control routes.
2. Identify the vulnerable endpoint: Target the gateway browser control routes — POST /wait/download or POST /download — on the OpenClaw server (default gateway port).
3. Craft a path traversal payload: Construct a request body with a malicious path parameter using directory traversal sequences, e.g., {"path": "../../etc/cron.d/backdoor", "ref": "e12"} for the /download route.
4. Send the request: Submit the crafted HTTP POST request to the vulnerable endpoint with the authenticated RPC token in the request headers.
5. Achieve arbitrary file write: The unsanitized path is resolved relative to the download directory root, allowing the downloaded content to be written to the attacker-specified location outside /tmp/openclaw/downloads, such as overwriting system files or planting a web shell or cron job for persistence (Github Advisory, Fix Commit).

• Network: Authenticated HTTP POST requests to OpenClaw gateway routes /wait/download, /download, or /trace/stop with path parameter values containing ../ sequences or absolute paths outside /tmp/openclaw.
• File System: Unexpected files written outside /tmp/openclaw/downloads or /tmp/openclaw by the OpenClaw process; new or modified files in sensitive directories (e.g., /etc/cron.d/, /etc/passwd, web root directories) with timestamps matching OpenClaw gateway activity.
• Logs: OpenClaw gateway access logs showing POST requests to /wait/download, /download, or /trace/stop with suspicious path values; absence of Invalid path error responses (HTTP 400) for requests containing traversal sequences in pre-patch versions.
• Process: Unexpected child processes or scheduled tasks spawned from the OpenClaw Node.js process following file write activity (Fix Commit).

Upgrade OpenClaw to version 2026.2.13 or later, which introduces the resolvePathWithinRoot function to validate and constrain all download and trace output paths to their respective temp root directories (/tmp/openclaw/downloads for downloads, /tmp/openclaw for traces). As a workaround prior to patching, restrict CLI access and gateway RPC token distribution to trusted administrators only, and implement network-level controls to limit access to the OpenClaw gateway. Monitor file system writes for suspicious path traversal activity (OpenClaw Release, OpenClaw Advisory).

The vulnerability was reported by security researcher @locus-x64 and credited in the official advisory. A brief mention appeared in a BeyondMachines digest noting that over 60 security vulnerabilities were resolved in the OpenClaw AI assistant release, of which this path traversal was one (BeyondMachines). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.