High severityNVD Advisory· Published Mar 5, 2026· Updated Mar 9, 2026
OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path
CVE-2026-28459
Description
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path outside the sessions directory to create files and append data repeatedly, potentially causing configuration corruption or denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.12 | 2026.2.12 |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/openclaw/openclaw/commit/25950bcbb8ba4d8cde002557f6e27c219ae4dedaghsapatchWEB
- github.com/openclaw/openclaw/commit/4199f9889f0c307b77096a229b9e085b8d856c26ghsapatchWEB
- github.com/advisories/GHSA-64qx-vpxx-mvqfghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-64qx-vpxx-mvqfghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-28459ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-arbitrary-file-write-via-untrusted-sessionfile-pathghsathird-party-advisoryWEB
- github.com/openclaw/openclaw/releases/tag/v2026.2.12ghsaWEB
News mentions
0No linked articles in our index yet.