OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download fi…

OpenClaw versions prior to 2026.2.13 contain a path traversal vulnerability in the browser control API. The vulnerability allows attackers with API access to write files outside intended temporary directories by exploiting user-supplied output paths for trace and download files. Three endpoints are affected: POST /trace/stop, POST /wait/download, and POST /download. The vulnerability stems from insufficient validation of user-supplied paths, allowing directory traversal attacks. Attackers can potentially write malicious files to arbitrary locations on the system.