Path traversal in OpenClaw browser upload allows local file read
OpenClaw's browser upload feature contained a path traversal vulnerability that allowed authenticated attackers to read arbitrary files from the Gateway host by supplying absolute paths or traversal sequences. The vulnerability was patched in version 2026.2.14.
What happened
Authenticated attackers could read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's upload action via POST /tools/invoke with {"tool":"browser","action":"upload",...} or POST /hooks/file-chooser.
The server passed upload paths to Playwright's setInputFiles() APIs without restricting them to a safe root, allowing the referenced files to be read from the local filesystem and contents exfiltrated by page JavaScript or via agent/browser snapshots.
Reported impact
The vulnerability enabled arbitrary local file read on the Gateway host, affecting confidentiality.
Index analysis
The vulnerability required authenticated access and the browser tool to be permitted by tool policy; in default setups the Gateway binds to loopback with a generated gateway token for onboarding.
Governance controls
Upload paths are now confined to OpenClaw's temp uploads root (DEFAULT_UPLOAD_DIR) and traversal/escape paths are rejected, as implemented in fix commit 3aa94af.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.