CVE-2026-28486

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

6.1

CVSS v4.0

6.8

EPSS

0.15%

Published

Mar 5, 2026

Modified

Mar 10, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outside the intended directory. Attackers can craft malicious archives that, when extracted via skills install, hooks install, plugins install, or signal install commands, write files to arbitrary locations enabling persistence or code execution.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Weaknesses (CWE)

CWE-22

Affected Products (2)

openclaw · openclaw (up to 2026.2.14)vulnerable

openclaw · openclawvulnerable

References (3)

https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87

Patch

https://github.com/openclaw/openclaw/security/advisories/GHSA-v892-hwpg-jwqp

Vendor Advisory

https://www.vulncheck.com/advisories/openclaw-path-traversal-zip-slip-in-archive-extraction-via-installation-commands

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs