CVE-2026-28453
criticalpriority · track · 39EPSS 0.004 · 38 %ileDEEUUSEPSS · scored 2026-10-27
OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.6–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0424OpenClaw: Mehrere SchwachstellenDeutsch2026-02-15csaf · cert_bundDE
Ein Angreifer kann diese Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.
- GHSA-p25h-9q54-ffvwOpenClaw has Zip Slip path traversal in tar archive extraction2026-03-02ghsa · osvUS
## Summary OpenClaw versions before 2026.2.14 did not sufficiently validate TAR archive entry paths during extraction. A crafted archive could use path traversal sequences (for example `../../...`) to write files outside the intended destination directory (Zip Slip). ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `< 2026.2.14` - Fixed: `>= 2026.2.14` ## Details The affected code path is `extractArchive()` in `src/infra/archive.ts`. Prior to 2026.2.14, TAR extraction used `tar.x({ cwd: destDir })` without rejecting traversal and absolute entry paths. This extraction is used by installation flows such as: - `openclaw plugins install …` - `openclaw hooks install …` ## Impact If a user installs an untrusted `.tar` / `.tgz` archive, an attacker can write files outside the extraction directory (within the permissions of the OpenClaw process). This can lead to configuration tampering and potentially code execution. ## Mitigation Upgrade to `openclaw >= 2026.2.14`. Avoid installing untrusted plugin/hook archives. ## Fix Commit(s) - `3aa94afcfd12104c683c9cad81faf434d0dadf87` OpenClaw thanks @xuemian168 for reporting.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87cnnvd
- https://github.com/openclaw/openclaw/releasesPatchcnnvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-p25h-9q54-ffvwcnnvd
- https://www.vulncheck.com/advisories/openclaw-zip-slip-path-traversal-in-tar-archive-extractioncnnvd
- https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87enisa_euvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-p25h-9q54-ffvwenisa_euvd
- https://www.vulncheck.com/advisories/openclaw-zip-slip-path-traversal-in-tar-archive-extractionenisa_euvd
- https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan