Which versions of Openviking are affected by CVE-2026-28518?

OpenViking versions 0.2.1 and earlier are vulnerable to path traversal attacks through malicious .ovpack files, potentially allowing unauthorized file writes to critical system locations.

How to fix or mitigate CVE-2026-28518?

Within 24 hours: inventory all systems running OpenViking 0.2.1 or earlier and isolate from production if possible; disable .ovpack import functionality if operationally feasible. Within 7 days: restrict file upload and import capabilities to trusted internal sources only; implement enhanced monitoring of file system write operations. Within 30 days: upgrade to patched version when released (monitor commit 46b3e76 status); validate patch deployment across all affected systems.

Openviking CVE-2026-28518

Q: What is the CVSS score of CVE-2026-28518?

CVE-2026-28518 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Path Traversal (CWE-22)

2026-03-03 disclosure@vulncheck.com

GHSA-rpqr-j937-6qr9

Path Traversal Openviking

8.4

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Apr 17, 2026 - 21:22 NVD

7.8 (HIGH) 8.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 03, 2026 - 15:16 nvd

HIGH 7.8

DescriptionCVE.org

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.

AnalysisAI

OpenViking 0.2.1 and earlier contain a path traversal vulnerability in .ovpack file imports that enables local attackers to write arbitrary files outside the intended directory by crafting malicious ZIP archives with traversal sequences or absolute paths. An attacker with user interaction can overwrite or create files with the privileges of the importing process, potentially leading to code execution or system compromise. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects the .ovpack import handling. OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.