A flaw in the browser upload workflow of OpenClaw allows an authenticated user to retrieve arbitrary files from the host system. By providing absolute paths or crafted path traversal sequences to the browser tool’s upload action, the server forwards these paths to Playwright’s file input APIs without constraining them to a safe directory. The flaw can lead to reading any file accessible to the process, resulting in confidentiality compromise. The weakness is a classic path traversal, identified as CWE‑22.

The vulnerability affects OpenClaw personal AI assistant versions prior to 2026.2.14. Only deployments that expose the Gateway HTTP interface, supply valid authentication (bearer token or password), and enable the browser tool within a session are susceptible. Default setups typically bind the gateway to loopback, but administrators who expose the gateway to LAN, tailnet, a reverse proxy, or tunnels expand the attacker’s reach.

The CVSS score is 7.1, indicating a high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the gateway and the presence of the browser tool in the tool policy. If the gateway is exposed beyond loopback, exploitation becomes feasible over the network, potentially allowing remote attackers to read sensitive files.