OpenClaw versions earlier than 2026.2.14 contain a path traversal flaw in the apply_patch routine that allows an attacker to craft file paths with traversal sequences or absolute locations. This flaw enables the creation, modification, or deletion of files outside the intended workspace, potentially allowing the attacker to place executable code or alter critical configuration files, thereby compromising confidentiality, integrity, and availability. The weakness is identified as CWE-22.

The vulnerability affects the OpenClaw software suite (vendor: openclaw, product: openclaw) in all releases prior to 2026.2.14. Versions 2026.2.13 and earlier are vulnerable; product versions 2026.2.14 and newer are not affected.

The CVSS v3.1 score is 8.7, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation appears to require access to the apply_patch interface, which is typically exposed via a local or network API. The likely attack vector is remote since the flaw can be triggered by sending a crafted request to the patch endpoint; however, this is inferred from the description and not explicitly stated.