CVE-2026-28447
OpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package Name
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names containing path traversal sequences like .. to write files outside the intended installation directory when victims run the plugins install command.
| CWE | CWE-22 |
| Vendor | openclaw |
| Product | openclaw |
| Published | Mar 5, 2026 |
| Last Updated | Mar 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new high vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
OpenClaw / OpenClaw
2026.1.29-beta.1 < 2026.2.1
References
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw github.com: https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-beta-path-traversal-in-plugin-installation-via-package-name
Credits
🔍 Aakash Japi (@logicx24)