CVE-2026-28447 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.1 contains a path traversal vulnerability caused by insufficient validation of plugin package names during installation, letting attackers write files outside the intended directory, exploit requires victim to run plugin install command.

Severity & Score

Impact

Attackers can write files outside the intended directory, potentially leading to arbitrary file modification or system compromise.

Mitigation

Update to version 2026.2.1 or later.

References

• https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw
• https://www.vulncheck.com/advisories/openclaw-beta-path-traversal-in-plugin-installation-via-package-name

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🟠 CVE-2026-28447 - High (7.5) OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names containing p... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28447/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner