Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized output path. When invoked via the browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory. This issue is not exposed via the AI agent tool schema (no `download` action). Exploitation requires authenticated CLI access or an authenticated gateway RPC token. Version 2026.2.13 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-26972 OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized output path. When invoked via … https://www.cve.org/CVERecord?id=CVE-2026-26972
Post summary
OpenClaw personal AI assistant (v2026.1.12‑2026.2.12) has an unsanitized output path flaw in its browser download helpers (CVE‑2026‑26972).
⚡ New CVE Alert: CVE-2026-26972 📊 Severity: 6.7 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-26972 #CVE-2026-26972 #CVE #Medium #CyberSecurity #InfoSec https://t.co/x4st235tWb
Post summary
The tweet announces a new CVE (CVE-2026-26972) with a medium severity score of 6.7, but provides no PoC, exploit code, or patch information.
CVE-2026-26972 Path Traversal in OpenClaw Browser Download Helpers 2026.1.12-2026.2.12 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26972
Post summary
A path traversal vulnerability (CVE‑2026‑26972) has been disclosed for OpenClaw Browser Download Helpers, with affected versions listed and further details available via the provided Vulmon link.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |