CVE-2026-28459
Received Received - Intake

Path Traversal in OpenClaw SessionFile Allows Denial of Service

Publication date: 2026-03-05

Last updated on: 2026-03-09

Assigner: VulnCheck

Description
OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path outside the sessions directory to create files and append data repeatedly, potentially causing configuration corruption or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-05
Last Modified
2026-03-09
Generated
2026-07-06
AI Q&A
2026-03-06
EPSS Evaluated
2026-07-05
NVD
CVE-2026-28459
EUVD
EUVD-2026-9907

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.2.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions prior to 2026.2.12, where the software fails to properly validate the sessionFile path parameter.

Because of this, authenticated gateway clients can specify a sessionFile path outside the intended sessions directory, allowing them to write transcript data to arbitrary locations on the host filesystem.

Attackers can create files or append data repeatedly in these arbitrary locations, which may lead to configuration corruption or denial of service.

Impact Analysis

The vulnerability allows authenticated users to write data to arbitrary locations on the host filesystem.

This can result in configuration corruption, which may disrupt normal operation of the system.

Additionally, repeated data writes could cause denial of service, potentially making the system unavailable or unstable.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart