CVE-2026-28447

HIGH EPSS 27.4%
Published Mar 5, 20263mo ago · Modified Jun 17, 20261w ago
7.0 CVSS 4.0
High
Find Similar
Published Mar 5, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names containing path traversal sequences like .. to write files outside the intended installation directory when victims run the plugins install command.

CVSS Details

Base Score
7.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
27.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
openclawopenclaw*≥2026.1.29  –  <2026.2.1

References 3

  • github.com https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57
    Patch
  • github.com https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw
    Vendor Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/openclaw-beta-path-traversal-in-plugin-installation-via-package-name
    Broken Link

Remediation

  • github.com https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57
    Patch