{"id":"CVE-2026-28486","aliases":["GHSA-v892-hwpg-jwqp"],"url":"https://o3.security/vulnerability/CVE-2026-28486","summary":"OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands","details":"## Summary\n\nA path traversal (Zip Slip) issue in archive extraction during explicit installation commands could allow a crafted archive to write files outside the intended extraction directory.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `>=2026.1.16-2 <2026.2.14`\n- Fixed version: `2026.2.14`\n\n## Affected Commands / Flows\n\nThis only affects users who run installation commands against an untrusted archive (local file or download URL), for example:\n\n- `openclaw skills install` (download+extract installers)\n- `openclaw hooks install` (archive installs)\n- `openclaw plugins install` (archive installs)\n- `openclaw signal install` (signal-cli asset extraction)\n\nIt is not triggered by receiving messages or normal gateway operation.\n\n## Impact\n\nArbitrary file write as the current user. In the worst case this can be used for persistence or code execution if an attacker can convince a user to install a crafted archive.\n\n## Fix\n\n- Fix commit: `3aa94afcfd12104c683c9cad81faf434d0dadf87`\n- Released in: `2026.2.14`\n\n## Credits\n\nOpenClaw thanks @markmusson for reporting.","published":"2026-03-05T22:00:02.515Z","modified":"2026-08-12T03:51:16.242277662Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.14"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87","label":"openclaw/openclaw@3aa94af"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28486.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v892-hwpg-jwqp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28486"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-path-traversal-zip-slip-in-archive-extraction-via-installation-commands"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.242277662Z"}}