A path traversal vulnerability in OpenClaw allows unauthenticated attackers to write arbitrary files to the system, potentially resulting in code execution or configuration tampering.

This is a path traversal flaw (CWE-22) caused by a failure to validate TAR archive entry paths. An unauthenticated attacker can supply a malicious archive containing traversal sequences, such as ../../, to overwrite sensitive files outside the extraction directory.

Successful exploitation of this vulnerability can lead to critical system compromise, including unauthorized code execution or the modification of application configurations. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data integrity and system availability, potentially leading to unauthorized control over the host environment.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Monitor system logs for unusual file write operations or unexpected file creation events in directories outside of the designated application workspace.

Compensating Controls: Implement strict file system permissions for the service account running OpenClaw to limit the impact of potential file write attempts, and ensure all incoming archives are scanned by security software before processing.

Public Exploit Available: Unknown.

The vulnerability represents a significant risk to system integrity and must be addressed with urgency. Organizations using OpenClaw should prioritize updating to version 2026.2.14 to eliminate the path traversal vector, as the ability for an attacker to write files outside of the application boundary is a critical security failure.