CVE-2026-26329

Description: The paths parameter of the browser upload action travels from POST /tools/invoke through the browser tool dispatch, the /hooks/file-chooser route, and toStringArray() in src/browser/routes/agent.act.ts into setInputFilesViaPlaywright(), where locator.setInputFiles(opts.paths) reads whatever it is given. No layer validates the path.

POST /tools/invoke
{ "tool": "browser", "action": "upload", "args": { "paths": ["/etc/passwd"] } }
  -> browser-tool.ts:603-635
  -> routes/agent.act.ts:335-365   const paths = toStringArray(body.paths)   // no validation
  -> pw-tools-core.interactions.ts:531   await locator.setInputFiles(opts.paths)

Four boundaries are crossed with no check at any of them: HTTP parsing and routing, tool dispatch, the browser control IPC boundary, and the Playwright call. That makes it systemic rather than a single missed guard. Affects openclaw before 2026.2.14.

Impact: Arbitrary local file read, exfiltrated through a file input on an attacker-chosen page.

No CVSS was assigned when the advisory published; the 7.1 recorded here is the CVSS v4.0 score carried on it now, and no v3.1 score has been assigned.