CVE-2026-28447

high

Description

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names containing path traversal sequences like .. to write files outside the intended installation directory when victims run the plugins install command.

References

https://www.vulncheck.com/advisories/openclaw-beta-path-traversal-in-plugin-installation-via-package-name

https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw

https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57

Details

Source: Mitre, NVD

Published: 2026-03-05

Updated: 2026-03-05

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 9.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High