PT-2026-27225 · Openclaw · Openclaw

Tdjackey · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-28483

NVD

CVSS v3.1

5.8

Medium

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

OpenClaw before 2026.3.2 contains a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory via parent-directory symlink rebind between path validation and file write operations. Attackers can exploit the gap between validation and truncate operations in src/infra/archive.ts to redirect writes outside the extraction root by manipulating parent directory symlinks.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-28483

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/7dac9b05dd9d38dd3929637f26fa356fd8bdd107 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28483 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r54r-wmmq-mh84 · Note
• https://vulncheck.com/advisories/openclaw-mar-arbitrary-file-write-via-zip-extraction-parent-symlink-race-condition · Note