CVE-2026-28453CWE-22

OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction

High · published March 5, 2026

CVSS v4.0
8.3
EPSS
1%
Percentile
46.8
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00578 · 46.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-05T21:59Z
EPSS history
Timeline
  • 05 MAR 21:59Z
    OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction
    cvelistv5