What is the CVSS score of CVE-2026-28462?

CVE-2026-28462 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-28462?

OpenClaw versions prior to 2026.2.13 contain a path traversal vulnerability that could allow attackers to write files outside intended directories, potentially compromising system integrity and data…. A patch is available.

How to fix or mitigate CVE-2026-28462?

Within 24 hours: Inventory all OpenClaw deployments and identify systems running versions prior to 2026.2.13. Within 7 days: Apply vendor patch 2026.2.13 or later to all affected systems in a staged manner, beginning with production environments. Within 30 days: Verify all patches have been successfully deployed, conduct validation testing of browser control API functionality, and document remediation completion.

Openclaw CVE-2026-28462

HIGH

Path Traversal (CWE-22)

2026-03-05 disclosure@vulncheck.com

GHSA-gq9c-wg68-gwj2

Path Traversal Openclaw

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 09, 2026 - 17:32 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST /trace/stop, POST /wait/download, and POST /download endpoints to write files outside intended temp roots.

AnalysisAI

OpenClaw versions before 2026.2.13 suffer from a path traversal vulnerability in the browser control API that allows authenticated attackers to write arbitrary files outside designated temporary directories via the trace and download endpoints. An attacker with API access can exploit this to place malicious files in unintended locations on the system. A patch is available to address this high-severity flaw.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Openclaw. OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST /trace/stop, POST /wait/download, and POST /download endpoints to write files outside intended temp roots.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.