OpenClaw before version 2026.4.10 contains a path‑traversal flaw in the screen_record tool’s outPath parameter that bypasses the intended workspace‑only filesystem restrictions. When an attacker supplies a path that points outside the workspace, the tool writes data to that location, allowing the creation or alteration of arbitrary files on the system. This vulnerability can be leveraged to tamper with configuration files, drop malicious payloads, or overwrite system binaries, potentially granting the attacker elevated privileges or remote code execution capabilities.

The affected product is OpenClaw as provided by the OpenClaw vendor. All releases prior to 2026.4.10 are vulnerable, and the issue is fixed in release 2026.4.10 and later.

The vulnerability has a CVSS score of 7.1, indicating high severity, and no EPSS score is currently available. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local execution of the screen_record tool by an attacker who can supply the outPath parameter, such as a user with access to the application or a process that can invoke it. Successful exploitation requires the ability to run screen_record and supply the outPath input, after which arbitrary file write becomes possible, potentially leading to privilege escalation or other malicious actions.