CVE-2026-28459
CVE-2026-28459 · OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path outside the sessions directory to create files and append data repeatedly, potentially causing configuration corruption or denial of service.
CVSS 7.1 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
Sources originales
- https://github.com/openclaw/openclaw/security/advisories/GHSA-64qx-vpxx-mvqf
- https://github.com/openclaw/openclaw/commit/4199f9889f0c307b77096a229b9e085b8d856c26
- https://github.com/openclaw/openclaw/commit/25950bcbb8ba4d8cde002557f6e27c219ae4deda
- https://www.vulncheck.com/advisories/openclaw-arbitrary-file-write-via-untrusted-sessionfile-path
- https://nvd.nist.gov/vuln/detail/CVE-2026-28459