OpenClaw versions prior to 2026.2.13 contain a path traversal vulnerability in the browser control API. The vulnerability allows attackers with API access to write files outside intended temporary directories by exploiting user-supplied output paths for trace and download files. Three endpoints are affected: POST /trace/stop, POST /wait/download, and POST /download. The vulnerability stems from insufficient validation of user-supplied paths, allowing directory traversal attacks. Attackers can potentially write malicious files to arbitrary locations on the system.