CVE-2026-28453: OpenClaw has Zip Slip path traversal in tar archive extraction
(updated )
OpenClaw versions before 2026.2.14 did not sufficiently validate TAR archive entry paths during extraction. A crafted archive could use path traversal sequences (for example ../../...) to write files outside the intended destination directory (Zip Slip).
References
- github.com/advisories/GHSA-p25h-9q54-ffvw
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87
- github.com/openclaw/openclaw/security/advisories/GHSA-p25h-9q54-ffvw
- nvd.nist.gov/vuln/detail/CVE-2026-28453
- www.vulncheck.com/advisories/openclaw-zip-slip-path-traversal-in-tar-archive-extraction
Code Behaviors & Features
Detect and mitigate CVE-2026-28453 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →