Executive brief
OpenClaw is a browser automation tool used as part of a platform for controlling web interactions. Authenticated attackers can read arbitrary files from the host running OpenClaw's Gateway by supplying malicious file paths to the browser upload feature. This allows an attacker with valid credentials to access sensitive configuration files, credentials, or other data stored on the server.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in OpenClaw's browser tool upload functionality. When handling upload requests via POST /tools/invoke or POST /hooks/file-chooser, the application passes user-supplied file paths directly to Playwright's setInputFiles() API without validating or sanitizing them. An authenticated attacker can supply absolute paths or path traversal sequences (e.g., ../../../etc/passwd) to read arbitrary files from the Gateway host. The contents are then attachable to a page-level input element and can be exfiltrated via FileReader or browser snapshots. Exploitation requires valid authentication (bearer token or password) and the browser tool must be permitted by policy. The fix, available in version 2026.2.14+, restricts upload paths to OpenClaw's temporary uploads directory and rejects traversal attempts.
Affected products
- OpenClaw openclaw < 2026.2.14
Timeline
- 2026-02-18: disclosed: GHSA published
- 2026-02-14: patched: Fix released in version 2026.2.14
- 2026-02-20: other: NVD published