VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026

CVE-2026-28453

CVE-2026-28453

Description

OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.2.142026.2.14

Affected products

3
  • OpenClaw/Openclaw2 versions
    cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.14
    • (no CPE)range: 0
  • ghsa-coords
    pkg:npm/openclaw
    Range: < 2026.2.14

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.