A path traversal vulnerability in OpenClaw allows unauthenticated attackers to achieve arbitrary file writes during plugin installation, posing a significant risk to system integrity.

This is a path traversal vulnerability (CWE-22) in the plugin installation process. An unauthenticated attacker can craft a malicious package name containing traversal sequences to write files outside of the intended directory when the install command is executed.

A successful exploit allows an attacker to overwrite critical system files or configuration files, potentially leading to a complete compromise of the application environment. Given the CVSS score of 8.1, this vulnerability is considered high severity, as it facilitates unauthorized file system modification that could lead to service disruption or further escalation of privileges.

Immediate Action: Update the OpenClaw package to version 2026.2.1 or later immediately via your package manager.

Proactive Monitoring: Review system logs for unusual file system write attempts or plugin installation activities that deviate from standard deployment patterns.

Compensating Controls: Ensure that the user account running the OpenClaw installation process operates with the principle of least privilege, specifically restricting write access to directories outside the application root.

Public Exploit Available: Unknown.

The high CVSS score reflects the significant risk posed by arbitrary file system writes within the application context. Organizations using affected versions of OpenClaw must prioritize the update to version 2026.2.1 to eliminate the path traversal vector. Immediate patching is the only effective way to prevent potential exploitation of this flaw.