What is the CVSS score of CVE-2026-28482?

CVE-2026-28482 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-28482?

OpenClaw installations are vulnerable to path traversal attacks that could allow unauthorized users to read or manipulate transcript files outside their intended directories.. A patch is available.

How to fix or mitigate CVE-2026-28482?

Within 24 hours: Identify all OpenClaw deployments and their versions; assess which systems are running versions prior to 2026.2.12 and prioritize business-critical instances. Within 7 days: Implement network segmentation to restrict OpenClaw access, deploy WAF rules to block path traversal patterns in sessionId and sessionFile parameters, and disable transcript functionality if not business-critical. Within 30 days: Upgrade to OpenClaw version 2026.2.12 or later; validate remediation through security testing.

Openclaw CVE-2026-28482

HIGH

Path Traversal (CWE-22)

2026-03-05 disclosure@vulncheck.com

GHSA-5xfq-5mr7-426q

Path Traversal Openclaw

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 7.1

DescriptionCVE.org

OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences like ../../etc/passwd in sessionId or sessionFile parameters to read or write arbitrary files outside the agent sessions directory.

AnalysisAI

OpenClaw versions before 2026.2.12 suffer from a path traversal vulnerability in transcript file handling that allows authenticated local users to read and modify arbitrary files on the system by injecting directory traversal sequences into sessionId or sessionFile parameters. An attacker with local access can exploit this to access sensitive files outside the intended agent sessions directory without additional privileges. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects the sessionId or sessionFile component of OpenClaw. OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences like ../../etc/passwd in sessionId or sessionFile parameters to read or write arbitrary files outside the agent sessions directory.