CVE-2026-28482 Details

A path traversal vulnerability has been identified in OpenClaw versions prior to 2026.2.12. The issue arises because the application constructs transcript file paths using unsanitized sessionId parameters and sessionFile paths, without enforcing that they remain within the designated agent sessions directory. This flaw allows authenticated attackers to exploit path traversal sequences, such as ../../etc/passwd, in the sessionId or sessionFile parameters to read or write arbitrary files outside the agent sessions directory.

Users are advised to upgrade to OpenClaw version 2026.2.12 or later, where this vulnerability has been fixed by validating session IDs, rejecting path separators and traversal sequences, and enforcing sessions-directory containment for transcript file operations.