BREW-openclaw-cli-CVE-2026-28462 — OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes

Affected: Homebrew: openclaw-cli

## Summary

OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently constraining writes to OpenClaw-managed temporary directories.

## Impact

If an attacker can access the browser control API, they could attempt to write trace/download output files outside intended temp roots, depending on process filesystem permissions.

## Affected versions

`openclaw` `< 2026.2.13`

## Fixed versions

`openclaw` `>= 2026.2.13`

## Remediation

Upgrade to `2026.2.13` or later.

## What changed

The fix constrains output paths for:

- `POST /trace/stop` - `POST /wait/download` - `POST /download`

All three now enforce OpenClaw temp-root boundaries and reject traversal/escape paths.

## Credits

Thanks to Adnan Jakati (@jackhax) of Praetorian for responsible disclosure.

Fix shipped in PR #15652 and merged to `main` on February 13, 2026 (`7f0489e4731c8d965d78d6eac4a60312e46a9426`).

---

Fix commit 7f0489e4731c8d965d78d6eac4a60312e46a9426 confirmed on main and in v2026.2.14. Upgrade to `openclaw >= 2026.2.13`.

CVE-2026-28462 — OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths

Affected: OpenClaw

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST /trace/stop, POST /wait/download, and POST /download endpoints to write files outside intended temp roots.

Most recent entries from all

BREW-openclaw-cli-CVE-2026-28462 — OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes

CVE-2026-28462 — OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths