OpenClaw Path Traversal in Browser Download Functionality
OpenClaw versions 2026.1.12 through 2026.2.12 contained a path traversal vulnerability in browser download functionality that allowed files to be written outside the intended directory when accessed via authenticated gateway routes. The vulnerability was patched in version 2026.2.13 and was not exposed through the AI agent tool schema.
What happened
OpenClaw's browser download helpers accepted unsanitized output paths. When invoked via browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory.
The issue affected versions 2026.1.12 through 2026.2.12 and was fixed in version 2026.2.13 by constraining paths to DEFAULT_DOWNLOAD_DIR via resolvePathWithinRoot. Exploitation required authenticated CLI access or an authenticated gateway RPC token.
Reported impact
This issue was not exposed via the AI agent tool schema as no download action is available to agents.
Governance controls
The affected code was in src/browser/pw-tools-core.downloads.ts within the waitForDownloadViaPlaywright and downloadViaPlaywright functions. Gateway browser control routes /wait/download and /download now restrict paths to OpenClaw temp roots.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.