CVE-2026-28518
Path Traversal in OpenViking .ovpack Import Allows Arbitrary File Write
Publication date: 2026-03-03
Last updated on: 2026-04-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| volcengine | openviking | to 0.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-28518 is a path traversal vulnerability in OpenViking versions 0.2.1 and earlier, specifically in the .ovpack import functionality. The vulnerability allows attackers to craft malicious ZIP archives containing unsafe pathnames such as directory traversal sequences (e.g., "../"), absolute paths, or Windows drive letter prefixes (e.g., "C:"). When these archives are imported, the software improperly validates the paths of the archive members, enabling attackers to write or overwrite files outside the intended import directory.'}, {'type': 'paragraph', 'content': 'This flaw arises because the import process does not rigorously check each zip entry path before extraction, allowing malicious files to escape the designated extraction folder and potentially overwrite arbitrary files with the privileges of the importing process.'}] [2, 3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can have serious impacts including unauthorized modification or creation of files outside the intended directory. An attacker who successfully exploits this flaw can overwrite critical system or application files, potentially leading to data corruption, system instability, or privilege escalation depending on the importing process's permissions."}, {'type': 'paragraph', 'content': "Because the attacker can write files with the importing process's privileges, this could lead to compromise of confidentiality, integrity, and availability of the affected system or application."}] [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by examining .ovpack ZIP archives for unsafe path entries such as directory traversal sequences (e.g., "../"), absolute paths (starting with "/"), Windows drive letter prefixes (e.g., "C:"), or backslash characters ("\\").'}, {'type': 'paragraph', 'content': 'To detect potentially malicious .ovpack files on your system, you can inspect the contents of these ZIP archives for unsafe paths before importing them.'}, {'type': 'paragraph', 'content': 'Suggested commands include using standard ZIP inspection tools to list archive contents and grep for suspicious patterns. For example:'}, {'type': 'list_item', 'content': 'Use unzip or zipinfo to list archive contents: unzip -l suspicious.ovpack'}, {'type': 'list_item', 'content': "Use unzip combined with grep to find entries with traversal or absolute paths: unzip -l suspicious.ovpack | grep -E '(\\.{2}/|^/|^[A-Za-z]:)'"}, {'type': 'list_item', 'content': 'Alternatively, use a script or tool that validates each ZIP member path against rules such as rejecting empty paths, backslashes, absolute paths, drive prefixes, and any ".." segments, similar to the validation implemented in the fix commit.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenViking to a version that includes the fix from commit 46b3e76, which enforces strict validation of .ovpack import paths to prevent path traversal.
If upgrading is not immediately possible, avoid importing untrusted or suspicious .ovpack archives, especially those obtained from unverified sources.
Additionally, implement manual or automated checks on .ovpack files before import to detect and reject archives containing unsafe paths such as traversal sequences, absolute paths, or Windows drive prefixes.
Restrict the privileges of the importing process to minimize potential damage if exploitation occurs.