Executive brief
OpenClaw is a browser automation and control library used by developers and AI agents to interact with web applications. A path traversal vulnerability in its download functionality allows attackers with authenticated access to write files outside the intended download directory, potentially overwriting system files or injecting malicious content.
Technical details
The vulnerability exists in OpenClaw's browser download helper functions (waitForDownloadViaPlaywright and downloadViaPlaywright in src/browser/pw-tools-core.downloads.ts) which accept unsanitized output paths. When invoked via the browser control gateway routes /wait/download and /download, the library fails to properly validate path traversal sequences (e.g., "../"), allowing an attacker to write downloaded content to arbitrary filesystem locations. Exploitation requires authenticated CLI access or a valid authenticated gateway RPC token; the vulnerability is not exposed via the AI agent tool schema. The fix (version 2026.2.13+) restricts paths to the DEFAULT_DOWNLOAD_DIR using resolvePathWithinRoot.
Affected products
- OpenClaw OpenClaw >=2026.1.12, <=2026.2.12
Timeline
- 2026-02-18: disclosed
- 2026-02-13: patched: Fix available in version 2026.2.13+