What is the CVSS score of CVE-2026-28453?

CVE-2026-28453 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-28453?

OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability that could allow attackers to write files outside intended directories during TAR archive extraction, potentially…. A patch is available.

How to fix or mitigate CVE-2026-28453?

Within 24 hours: Inventory all systems running OpenClaw and identify those below version 2026.2.14. Within 7 days: Apply vendor patch 2026.2.14 or later to all affected systems, prioritizing production environments. Within 30 days: Conduct verification testing and complete patching across all remaining systems including development and test environments.

Openclaw CVE-2026-28453

HIGH

Path Traversal (CWE-22)

2026-03-05 disclosure@vulncheck.com

GHSA-p25h-9q54-ffvw

Path Traversal Openclaw

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 09, 2026 - 18:04 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 7.5

DescriptionCVE.org

OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.

AnalysisAI

OpenClaw before version 2026.2.14 fails to properly validate file paths when extracting TAR archives, enabling attackers to use path traversal sequences to write files outside the intended extraction directory. An unauthenticated remote attacker can exploit this to overwrite configuration files or inject malicious code into the system. A patch is available for affected versions.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Openclaw. OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.