GitHub Advisoryadvisory · npm

GHSA-5xfq-5mr7-426q OpenClaw's unsanitized session ID enables path traversal in transcript file operations

HIGH Published 2026-02-18 Modified 2026-03-06 Official page ↗
Aliases
CVE-2026-28482
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-02-18

Affected packages

• npm openclaw: < 2026.2.12 → fixed in 2026.2.12

Description

Description OpenClaw versions **= 2026.2.12` Fix Fixed by validating session IDs (rejecting path separators / traversal sequences) and enforcing sessions-directory containment for session transcript file operations. Fix Commit(s) • `4199f9889f0c307b77096a229b9e085b8d856c26` Additional Hardening • `cab0abf52ac91e12ea7a0cf04fff315cf0c94d64` Mitigation Upgrade to `openclaw >= 2026.2.12`. Thanks @akhmittra for reporting.

Related

Alias · CVE (1)

  • CVE-2026-28482 OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References