●PocketClawAI security alerts
Sign in
mediumCVSS 6.1NVD status: Analyzed

CVE-2026-28486

OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outside the intended directory.

ComponentOpenClaw
Severitymedium (CVSS 6.1)
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Published (NVD)2026-03-05
Last modified2026-06-17
Affected versions
openclaw >= 2026.1.20, < 2026.2.14
openclaw = 2026.1.16-2
Fixed in2026.2.14
WeaknessCWE-22
CISA KEVnot listed

NVD description

OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outside the intended directory. Attackers can craft malicious archives that, when extracted via skills install, hooks install, plugins install, or signal install commands, write files to arbitrary locations enabling persistence or code execution.

Does CVE-2026-28486 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for OpenClaw.
Check my stack

What to do

  • Upgrade OpenClaw to 2026.2.14 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other OpenClaw CVEs

medium
CVE-2026-108757CVSS 6.5

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips...

OpenClaw
2026-10-11high
CVE-2026-101884CVSS 7.5

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*,...

OpenClaw
2026-09-30high
CVE-2026-101880CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShe...

OpenClaw
2026-09-30medium
CVE-2026-101881CVSS 6.5

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport th...

OpenClaw
2026-09-30medium
CVE-2026-101883CVSS 5.4

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses U...

OpenClaw
2026-09-30high
CVE-2026-101882CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-exec...

OpenClaw
2026-09-30

All OpenClaw CVEs