5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5xfq-5mr7-426q

GHSA-5xfq-5mr7-426q: OpenClaw's unsanitized session ID enables path traversal in transcript file operations

Description

OpenClaw versions <= 2026.2.9 construct transcript file paths using an unsanitized sessionId and also accept sessionFile paths without enforcing that they stay within the agent sessions directory.

A crafted sessionId and/or sessionFile (example: ../../etc/passwd) can cause path traversal when the gateway performs transcript file read/write operations.

Preconditions: an attacker must be able to authenticate to the gateway (gateway token/password). By default the gateway binds to loopback (local-only); configurations that expose the gateway widen the attack surface.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.9
Fixed: >= 2026.2.12

Fix

Fixed by validating session IDs (rejecting path separators / traversal sequences) and enforcing sessions-directory containment for session transcript file operations.

Fix Commit(s)

4199f9889f0c307b77096a229b9e085b8d856c26

Additional Hardening

cab0abf52ac91e12ea7a0cf04fff315cf0c94d64

Mitigation

Upgrade to openclaw >= 2026.2.12.

Thanks @akhmittra for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5xfq-5mr7-426q

GHSA-5xfq-5mr7-426q:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.12	2026.2.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue (CWE-22) within the OpenClaw application, affecting versions up to 2026.2.9. The root cause is the improper handling of sessionId and sessionFile parameters, which were used to construct file paths for session transcripts without proper sanitization or validation.

The analysis of the fix commit 4199f9889f0c307b77096a229b9e085b8d856c26 reveals that several functions were involved in creating and using these unsafe paths. The core of the fix was to introduce validation for session IDs and to ensure that any resolved file path is strictly contained within the designated agent sessions directory.

The primary vulnerable function was resolveSessionFilePath, which previously returned user-provided paths without validation. This function was called by multiple other parts of the application that perform file operations, such as appendAssistantMessageToSessionTranscript (for writing) and the various usageHandlers (for reading). An attacker with gateway authentication could send a crafted request with a malicious sessionId or sessionFile (e.g., ../../etc/passwd) to trigger these functions, leading to arbitrary file reads or writes on the server's filesystem. The patch addresses this by rewriting the path resolution logic to be secure by default, rejecting any path that attempts to escape the sessions directory.

Vulnerable functions

resolveSessionFilePath

src/config/sessions/paths.ts

The original implementation of this function returned the `sessionFile` path directly from the session entry or constructed a path from the `sessionId` without any validation. This allowed an attacker to provide a path with traversal sequences (e.g., `../../etc/passwd`) in either `sessionFile` or `sessionId`, causing the application to write to or read from arbitrary files on the system.

appendAssistantMessageToSessionTranscript

src/config/sessions/transcript.ts

This function is responsible for appending messages to a session's transcript file. It used the vulnerable path resolution logic by directly calling `resolveSessionTranscriptPath` or using the untrusted `entry.sessionFile` value. An attacker could exploit this to have the application write transcript data to an arbitrary file, as the file path was not sanitized.

resolveTranscriptPath

src/gateway/server-methods/chat.ts

This function, local to the gateway chat handlers, constructed the transcript file path. The original implementation performed a direct and unsafe `path.join` using the unsanitized `sessionId`, or it directly returned the unsanitized `sessionFile` path. This made any gateway operation using this function (like `chat.inject`) vulnerable to path traversal.

usageHandlers

src/gateway/server-methods/usage.ts

The `usageHandlers` object contains methods for querying session usage (`sessions.usage`, `sessions.usage.timeseries`, etc.). These handlers resolved session file paths to read usage data. They were vulnerable because they used the insecure `resolveSessionFilePath` function, allowing an attacker to craft a request with a malicious session key that points to an arbitrary file on the filesystem, causing that file's stats to be read instead of the session transcript.

resolveSessionTranscriptCandidates

src/gateway/session-utils.fs.ts

This function was responsible for generating a list of potential transcript file paths. Before the patch, it would unsafely add the raw `sessionFile` path and paths constructed with `path.join` to its list of candidates. This list of potentially malicious paths was then used by other functions, propagating the path traversal vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-5xfq-5mr7-426q: OpenClaw's unsanitized session ID enables path traversal in transcript file operations

Description

Affected Packages / Versions

Fix

Fix Commit(s)

Additional Hardening

Mitigation

GHSA-5xfq-5mr7-426q:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-5xfq-5mr7-426q: OpenClaw's unsanitized session ID enables path traversal in transcript file operations

Description

Affected Packages / Versions

Fix

Fix Commit(s)

Additional Hardening

Mitigation

Basic Information

Basic Information

Technical Details

5.5

5.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI