{"id":"GHSA-cv7m-c9jx-vg7q","summary":"OpenClaw has a path traversal in browser upload allows local file read","details":"## Summary\n\nAuthenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's `upload` action. The server passed these paths to Playwright's `setInputFiles()` APIs without restricting them to a safe root.\n\nSeverity remains **High** due to the impact (arbitrary local file read on the Gateway host), even though exploitation requires authenticated access.\n\n## Exploitability / Preconditions\n\nThis is not a \"drive-by\" issue.\n\nAn attacker must:\n\n- Reach the Gateway HTTP surface (or otherwise invoke the same browser control hook endpoints).\n- Present valid Gateway auth (bearer token / password), as required by the Gateway configuration.\n  - In common default setups, the Gateway binds to loopback and the onboarding wizard generates a gateway token even for loopback.\n- Have the `browser` tool permitted by tool policy for the target session/context (and have browser support enabled).\n\nIf an operator exposes the Gateway beyond loopback (LAN/tailnet/custom bind, reverse proxy, tunnels, etc.), the impact increases accordingly.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Vulnerable: `\u003c 2026.2.14` (includes latest published `2026.2.13`)\n- Patched: `\u003e= 2026.2.14` (planned next release)\n\n## Details\n\n**Entry points**:\n\n- `POST /tools/invoke` with `{\"tool\":\"browser\",\"action\":\"upload\",...}`\n- `POST /hooks/file-chooser` (browser control hook)\n\nWhen the upload paths are not validated, Playwright reads the referenced files from the local filesystem and attaches them to a page-level `\u003cinput type=\"file\"\u003e`. Contents can then be exfiltrated by page JavaScript (e.g. via `FileReader`) or via agent/browser snapshots.\n\nImpact: arbitrary local file read on the Gateway host (confidentiality impact).\n\n## Fix\n\nUpload paths are now confined to OpenClaw's temp uploads root (`DEFAULT_UPLOAD_DIR`) and traversal/escape paths are rejected.\n\nThis fix was implemented internally; the reporter provided a clear reproduction and impact analysis.\n\nFix commit(s):\n\n- 3aa94afcfd12104c683c9cad81faf434d0dadf87\n\nThanks @p80n-sec for reporting.","aliases":["CVE-2026-26329"],"modified":"2026-02-20T16:52:49.886510Z","published":"2026-02-18T00:46:49Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-02-18T00:46:49Z","nvd_published_at":"2026-02-20T00:16:15Z","cwe_ids":["CWE-22"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cv7m-c9jx-vg7q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26329"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"}],"affected":[{"package":{"name":"openclaw","ecosystem":"npm","purl":"pkg:npm/openclaw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.14"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cv7m-c9jx-vg7q/GHSA-cv7m-c9jx-vg7q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}