PT-2026-22744 · Unknown · Openviking

Ernkastel · Published 2026-03-03 · Updated 2026-03-03 · CVE-2026-28518

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OpenViking versions prior to 0.2.1

Description The software contains a path traversal issue in the handling of .ovpack imports. This allows attackers to write files outside the intended import directory. Attackers can create malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.

Recommendations Update to version 0.2.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-28518

GHSA-RPQR-J937-6QR9

Affected Products

Openviking

References · 13

• 🔥 https://github.com/volcengine/OpenViking/issues/342 · Exploit
• https://github.com/volcengine/OpenViking/commit/46b3e76e28b9b3eee73693720c9ec48820228b72 · Patch
• https://vulncheck.com/advisories/openviking-ovpack-import-zip-slip-path-traversal · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28518 · Security Note
• https://osv.dev/vulnerability/GHSA-rpqr-j937-6qr9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28518 · Vendor Advisory
• https://github.com/volcengine/OpenViking · Note
• https://twitter.com/infoflowcloud/status/2028850708989067458 · Twitter Post
• https://t.me/CVEtracker/46212 · Telegram Post
• https://twitter.com/CVEnew/status/2028849465394880608 · Twitter Post
• https://t.me/cveNotify/154044 · Telegram Post
• https://twitter.com/cyberbivash/status/2028873066629992550 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028860230520480186 · Twitter Post