GHSA-gq9c-wg68-gwj2: OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes

February 18, 2026

OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently constraining writes to OpenClaw-managed temporary directories.

References

github.com/advisories/GHSA-gq9c-wg68-gwj2
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/7f0489e4731c8d965d78d6eac4a60312e46a9426
github.com/openclaw/openclaw/pull/15652
github.com/openclaw/openclaw/security/advisories/GHSA-gq9c-wg68-gwj2

Code Behaviors & Features

Detect and mitigate GHSA-gq9c-wg68-gwj2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →