https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T15:11:36.357212+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28482 BREW-openclaw-cli-CVE-2026-28482 — OpenClaw's unsanitized session ID enables path traversal in transcript file operations 2026-09-28T15:11:36.359382+00:00

Affected: Homebrew: openclaw-cli

## Description

OpenClaw versions **<= 2026.2.9** construct transcript file paths using an unsanitized `sessionId` and also accept `sessionFile` paths without enforcing that they stay within the agent sessions directory.

A crafted `sessionId` and/or `sessionFile` (example: `../../etc/passwd`) can cause path traversal when the gateway performs transcript file read/write operations.

**Preconditions:** an attacker must be able to authenticate to the gateway (gateway token/password). By default the gateway binds to `loopback` (local-only); configurations that expose the gateway widen the attack surface.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected: `<= 2026.2.9` - Fixed: `>= 2026.2.12`

## Fix

Fixed by validating session IDs (rejecting path separators / traversal sequences) and enforcing sessions-directory containment for session transcript file operations.

### Fix Commit(s)

- `4199f9889f0c307b77096a229b9e085b8d856c26`

### Additional Hardening

- `cab0abf52ac91e12ea7a0cf04fff315cf0c94d64`

## Mitigation

Upgrade to `openclaw >= 2026.2.12`.

Thanks @akhmittra for reporting.

 https://db.gcve.eu/vuln/cve-2026-28482 CVE-2026-28482 — OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters 2026-09-28T15:11:36.359460+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences like ../../etc/passwd in sessionId or sessionFile parameters to read or write arbitrary files outside the agent sessions directory.