OpenClaw’s browser download helpers accept an unsanitized output path, allowing a user with authenticated CLI access or an authenticated gateway RPC token to perform path traversal and write files outside the intended temporary downloads directory. The flaw can be used to place files at arbitrary locations within the host file system when the download feature is invoked through the browser control gateway routes, potentially disrupting the normal operation of the application.

This vulnerability affects OpenClaw personal AI assistant versions 2026.1.12 through 2026.2.12, which are built on Node.js. The issue exists on any operating system where the application is installed. Version 2026.2.13 removes the flaw.

The CVSS score of 6.7 indicates medium severity, and the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread. The flaw is not listed in the CISA KEV catalog. Attackers need authenticated access via the CLI or a gateway RPC token, which limits the attack surface to compromised accounts. Once authentication is achieved, the path traversal can be leveraged to write arbitrary files, presenting a medium risk to the confidentiality and integrity of the affected system.