CVE-2026-43567
OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter
OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter
OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.
- Record
CVE-2026-43567- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-27285
OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.
- Record
EUVD-2026-27285- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jf25-7968-h2h5
OpenClaw: screen_record outPath bypassed workspace-only filesystem guard
Summary
screen_record outPath bypassed workspace-only filesystem guard.
Affected Packages / Versions
- Package:
openclaw - Ecosystem: npm
- Affected versions:
< 2026.4.10 - Patched versions:
>= 2026.4.10
Impact
The node-host screen recording tool could honor an outPath outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.
Technical Details
The fix applies the workspace-root guard to node tool outPath handling, including screen recording paths.
Fix
The issue was fixed in #63551. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.
Fix Commit(s)
635bb35b68d8faa5bfa2fda35feadd315122748a- PR: #63551
Release Process Note
Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.
Credits
Thanks to @anshumanbh for reporting this issue.
- Record
GHSA-jf25-7968-h2h5- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22, CWE-863
- Updated
- 2026-11-02
NVD
OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.
- Record
CVE-2026-43567- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter
OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.
- Record
CVE-2026-43567- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-jf25-7968-h2h5
OpenClaw: screen_record outPath bypassed workspace-only filesystem guard
Summary
screen_record outPath bypassed workspace-only filesystem guard.
Affected Packages / Versions
- Package:
openclaw - Ecosystem: npm
- Affected versions:
< 2026.4.10 - Patched versions:
>= 2026.4.10
Impact
The node-host screen recording tool could honor an outPath outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.
Technical Details
The fix applies the workspace-root guard to node tool outPath handling, including screen recording paths.
Fix
The issue was fixed in #63551. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.
Fix Commit(s)
635bb35b68d8faa5bfa2fda35feadd315122748a- PR: #63551
Release Process Note
Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.
Credits
Thanks to @anshumanbh for reporting this issue.
- Record
GHSA-jf25-7968-h2h5- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22, CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openclawnpm |
before 2026.4.10 | 2026.4.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-43567 is a high vulnerability (CVSS 7.1) in Openclaw, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in openclaw 2026.4.10.
References
github.com/openclaw/openclaw/security/advisories/GHSA-jf25-7968-h2h5
vulncheck.com/advisories/openclaw-path-traversal-in-screen-record-outpath-parameter
nvd.nist.gov/vuln/detail/CVE-2026-43567