CVE-2026-43567CWE-862

OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter

High · published May 5, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00392 · 32.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-05T11:25Z
EPSS history
Timeline
  • 05 MAY 11:25Z
    OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter
    cvelistv5