CVE-2026-28459
OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path outside the sessions directory to create files and append data repeatedly, potentially causing configuration corruption or denial of service.
| CWE | CWE-73 |
| Vendor | openclaw |
| Product | openclaw |
| Published | Mar 5, 2026 |
| Last Updated | Mar 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new high vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
OpenClaw / OpenClaw
0 < 2026.2.12
References
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-64qx-vpxx-mvqf github.com: https://github.com/openclaw/openclaw/commit/4199f9889f0c307b77096a229b9e085b8d856c26 github.com: https://github.com/openclaw/openclaw/commit/25950bcbb8ba4d8cde002557f6e27c219ae4deda vulncheck.com: https://www.vulncheck.com/advisories/openclaw-arbitrary-file-write-via-untrusted-sessionfile-path
Credits
🔍 Tuba Deligoz (@tubadeligoz)