OpenClaw versions prior to 2026.2.12 allow an authenticated gateway client to specify an arbitrary sessionFile path, bypassing validation and enabling the client to write data to any location on the host system. The vulnerability stems from CWE‑73, resulting in the ability to overwrite or create arbitrary files, which can corrupt configurations or serve as a vector for denial of service by exhausting disk space or corrupting critical files.

The affected software is OpenClaw OpenClaw, with all releases below 2026.2.12 susceptible. The vulnerability specifically targets the sessionFile parameter handling within the gateway client component, meaning all installations prior to version 2026.2.12 are at risk.

The CVSS score of 7.1 indicates a high severity. The EPSS score is below 1%, suggesting that exploitation is not common but still possible. This vulnerability is not listed in the KEV catalog. Exploitation requires an authenticated client with access to the gateway, so attackers must first compromise a valid user account or gain legitimate gateway access, after which they can supply a crafted sessionFile path to create or overwrite files anywhere on the host. The risk is elevated if the application runs with elevated privileges or if the filesystem is writable by the process.