CVE-2026-28453: OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction
OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28453?
CVE-2026-28453 has a high severity rating due to its potential for exploitation through path traversal attacks.
How do I fix CVE-2026-28453?
To fix CVE-2026-28453, update OpenClaw to version 2026.2.14 or later.
What are the risks associated with CVE-2026-28453?
Risks associated with CVE-2026-28453 include unauthorized file access and the ability for attackers to overwrite critical files.
Who is affected by CVE-2026-28453?
Any users or organizations utilizing OpenClaw versions prior to 2026.2.14 are affected by CVE-2026-28453.
What types of attacks can exploit CVE-2026-28453?
CVE-2026-28453 can be exploited through crafted TAR archives that use path traversal sequences to access unintended file locations.