CVE-2026-28459
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path outside the sessions directory to create files and append data repeatedly, potentially causing configuration corruption or denial of service.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.36% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-73
- Affected
- openclaw/openclaw
- Source
- disclosure@vulncheck.com
References
- https://github.com/openclaw/openclaw/commit/25950bcbb8ba4d8cde002557f6e27c219ae4dedaPatch
- https://github.com/openclaw/openclaw/commit/4199f9889f0c307b77096a229b9e085b8d856c26Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-64qx-vpxx-mvqfPatch, Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-arbitrary-file-write-via-untrusted-sessionfile-pathThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.