CVE-2026-28483
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
CVE-2026-28483 has been rejected by its source and should not be treated as a live vulnerability, published March 3, 2026. Fixed in openclaw 2026.3.2.
- Severity
- 8.7 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2026.3.2openclaw +1 more
Description
This CVE ID has been rejected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected packages
What each source reports
GitHub Advisories Score usedGHSA-r54r-wmmq-mh84
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Summary
ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write.
Affected Packages / Versions
- Package:
openclaw(npm) - Vulnerable versions:
<= 2026.3.1 - Latest published vulnerable version confirmed:
2026.3.1(npm as of 2026-03-02) - Patched version:
2026.3.2(released)
Technical Details
In src/infra/archive.ts, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root.
The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in src/infra/fs-safe.ts and regression coverage in src/infra/archive.test.ts.
Fix Commit(s)
7dac9b05dd9d38dd3929637f26fa356fd8bdd107
- Record
GHSA-r54r-wmmq-mh84- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-59, CWE-367
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID has been rejected.
- Record
CVE-2026-28483- Updated
- 2026-11-02
EUVDEUVD-2026-14561
This CVE ID has been rejected.
- Record
EUVD-2026-14561- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE ID has been rejected.
- Record
CVE-2026-28483- Updated
- 2026-11-02
OSVCVE-2026-27670
OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition
OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.
- Record
CVE-2026-27670- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-367
- Updated
- 2026-11-02
OSVGHSA-r54r-wmmq-mh84
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Summary
ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write.
Affected Packages / Versions
- Package:
openclaw(npm) - Vulnerable versions:
<= 2026.3.1 - Latest published vulnerable version confirmed:
2026.3.1(npm as of 2026-03-02) - Patched version:
2026.3.2(released)
Technical Details
In src/infra/archive.ts, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root.
The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in src/infra/fs-safe.ts and regression coverage in src/infra/archive.test.ts.
Fix Commit(s)
7dac9b05dd9d38dd3929637f26fa356fd8bdd107
- Record
GHSA-r54r-wmmq-mh84- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-367, CWE-59
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/openclaw/openclaw/security/advisories/GHSA-r54r-wmmq-mh84
nvd.nist.gov/vuln/detail/CVE-2026-27670
vulncheck.com/advisories/openclaw-arbitrary-file-write-via-zip-extraction-parent-symlink-race-condition