CVE-2026-28483

✕ Withdrawn — historical dataHIGHCVSS · not yet scored
—

OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind

Summary

ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Vulnerable versions: <= 2026.3.1
  • Latest published vulnerable version confirmed: 2026.3.1 (npm as of 2026-03-02)
  • Patched version: 2026.3.2 (released)

Technical Details

In src/infra/archive.ts, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root.

The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in src/infra/fs-safe.ts and regression coverage in src/infra/archive.test.ts.

Fix Commit(s)

  • 7dac9b05dd9d38dd3929637f26fa356fd8bdd107

CVSS v3
—
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

March 3, 2026

Last Modified

March 3, 2026

Frequently asked(3)

What is CVE-2026-28483?
CVE-2026-28483 is a rejected CVE ID: its record was withdrawn on March 23, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected.
When was the CVE record for CVE-2026-28483 published?
The CVE record for CVE-2026-28483 was published on March 3, 2026. EchelonGraph's copy of the record carries a last-modified date of March 3, 2026; the record at its source may have been updated since.
How do I remediate CVE-2026-28483?
There is nothing to remediate under CVE-2026-28483: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.