PT-2026-23531 · Openclaw · Openclaw

Shangzhi-Xu + 1 · Published 2026-03-02 · Updated 2026-03-07 · CVE-2026-28453

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14

Description OpenClaw versions before 2026.2.14 do not properly validate TAR archive entry paths during extraction. A crafted archive can use path traversal sequences, such as ../../..., to write files outside the intended destination directory, a condition known as Zip Slip. The affected code path is the extractArchive() function in src/infra/archive.ts, which used tar.x({ cwd: destDir }) without rejecting traversal and absolute entry paths. This issue affects installation flows, including openclaw plugins install and openclaw hooks install. An attacker who successfully exploits this issue can write files outside the extraction directory with the permissions of the OpenClaw process, potentially leading to configuration tampering and code execution.

Recommendations Upgrade to OpenClaw version 2026.2.14 or later. Avoid installing untrusted plugin or hook archives.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-28453

GHSA-P25H-9Q54-FFVW

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-p25h-9q54-ffvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28453 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p25h-9q54-ffvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28453 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-zip-slip-path-traversal-in-tar-archive-extraction · Note
• https://twitter.com/CVEnew/status/2030385190787244168 · Twitter Post