CVE-2026-28482
CVE-2026-28482 · OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences like ../../etc/passwd in sessionId or sessionFile parameters to read or write arbitrary files outside the agent sessions directory.
CVSS 8.4 · Alta · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
Fuentes originales
- https://github.com/openclaw/openclaw/security/advisories/GHSA-5xfq-5mr7-426q
- https://github.com/openclaw/openclaw/commit/4199f9889f0c307b77096a229b9e085b8d856c26
- https://github.com/openclaw/openclaw/commit/cab0abf52ac91e12ea7a0cf04fff315cf0c94d64
- https://www.vulncheck.com/advisories/openclaw-path-traversal-via-unsanitized-sessionid-and-sessionfile-parameters
- https://nvd.nist.gov/vuln/detail/CVE-2026-28482