CVE-2026-28518

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28518", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-27T21:07:55.466Z", "datePublished": "2026-03-03T14:36:13.472Z", "dateUpdated": "2026-10-08T15:22:21.080Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:22:21.080Z"}, "title": "OpenViking .ovpack Import ZIP Slip Path Traversal", "descriptions": [{"lang": "en", "value": "OpenViking versions 0.2.1 and prior, fixed in commit\u00a046b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges."}]}], "affected": [{"vendor": "Volcengine", "product": "OpenViking", "repo": "https://github.com/volcengine/OpenViking", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "0.2.1", "versionType": "semver"}, {"status": "unaffected", "version": "46b3e76e28b9b3eee73693720c9ec48820228b72", "versionType": "git"}], "defaultStatus": "unaffected", "packageURL": "pkg:pypi/openviking"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:volcengine:openviking:*:*:*:*:*:*:*:*", "versionEndIncluding": "0.2.1"}]}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "EXTERNAL"}, "references": [{"url": "https://github.com/volcengine/OpenViking/issues/342", "tags": ["issue-tracking"]}, {"url": "https://github.com/volcengine/OpenViking/commit/46b3e76e28b9b3eee73693720c9ec48820228b72", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/openviking-ovpack-import-zip-slip-path-traversal", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Chia Min Jun Lennon", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"references": [{"url": "https://github.com/volcengine/OpenViking/issues/342", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T21:29:17.100250Z", "id": "CVE-2026-28518", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T21:29:20.752Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28518", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T21:29:17.100250Z"}}}], "references": [{"url": "https://github.com/volcengine/OpenViking/issues/342", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T21:29:10.788Z"}}], "cna": {"title": "OpenViking .ovpack Import ZIP Slip Path Traversal", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Chia Min Jun Lennon"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/volcengine/OpenViking", "vendor": "Volcengine", "product": "OpenViking", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.2.1"}, {"status": "unaffected", "version": "46b3e76e28b9b3eee73693720c9ec48820228b72", "versionType": "git"}], "packageURL": "pkg:pypi/openviking", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/volcengine/OpenViking/issues/342", "tags": ["issue-tracking"]}, {"url": "https://github.com/volcengine/OpenViking/commit/46b3e76e28b9b3eee73693720c9ec48820228b72", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/openviking-ovpack-import-zip-slip-path-traversal", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "OpenViking versions 0.2.1 and prior, fixed in commit\u00a046b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.", "supportingMedia": [{"type": "text/html", "value": "OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:volcengine:openviking:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.2.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:22:21.080Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28518", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:22:21.080Z", "dateReserved": "2026-02-27T21:07:55.466Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-03T14:36:13.472Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/openviking", "product": "OpenViking", "repo": "https://github.com/volcengine/OpenViking", "vendor": "Volcengine", "versions": [{"lessThanOrEqual": "0.2.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "46b3e76e28b9b3eee73693720c9ec48820228b72", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:volcengine:openviking:*:*:*:*:*:*:*:*", "matchCriteriaId": "E66C393D-9F4B-4DC0-BA3B-517F825A09FE", "versionEndExcluding": "0.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenViking versions 0.2.1 and prior, fixed in commit\u00a046b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges."}, {"lang": "es", "value": "Las versiones 0.2.1 y anteriores de OpenViking, corregidas en el commit 46b3e76, contienen una vulnerabilidad de salto de ruta en el manejo de importaci\u00f3n de archivos .ovpack que permite a los atacantes escribir archivos fuera del directorio de importaci\u00f3n previsto. Los atacantes pueden crear archivos ZIP maliciosos con secuencias de salto de ruta, rutas absolutas o prefijos de unidad en los nombres de los miembros para sobrescribir o crear archivos arbitrarios con los privilegios del proceso de importaci\u00f3n."}], "id": "CVE-2026-28518", "lastModified": "2026-10-08T16:17:12.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28518", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T21:29:17.100250Z", "version": "2.0.3"}}]}, "published": "2026-03-03T15:16:20.593", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/volcengine/OpenViking/commit/46b3e76e28b9b3eee73693720c9ec48820228b72"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking"], "url": "https://github.com/volcengine/OpenViking/issues/342"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/openviking-ovpack-import-zip-slip-path-traversal"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking"], "url": "https://github.com/volcengine/OpenViking/issues/342"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.2.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "46b3e76"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenViking", "source": "cna", "vendor": "Volcengine"}, "product": "openviking", "vendor": "volcengine"}], "analysis": {"en": {"generated_at": "2026-04-16T05:46:17.695787+00:00", "value": {"mitigation_remediation": ["Apply the security fix from commit\u202f46b3e76 or upgrade to a later OpenViking release that includes the patch.", "Restrict who can perform .ovpack imports by limiting user permissions or disabling the import feature for untrusted entities.", "Implement monitoring to alert on file changes outside the expected import directory to detect potential abuse."], "summary": {"action": "Patch Immediately", "impact": "Arbitrary File Write"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Volcengine OpenViking product, specifically versions 0.2.1 and all earlier releases.", "description_and_impact": "OpenViking processes .ovpack files by extracting ZIP archives into a target directory. In versions 0.2.1 and earlier the implementation fails to sanitize archive member names, allowing a malicious ZIP to include traversal sequences, absolute paths, or drive prefixes. When the import routine extracts such entries, it can write files outside the intended import directory, potentially overwriting or creating any file the importing process can access, which may include configuration files or executables. This flaw enables an attacker to influence the integrity and availability of the system, and if the import runs with elevated privileges, to compromise the whole system.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.4, indicating high severity. The EPSS score is less than 1%, suggesting that exploitation is currently rare but still possible. It is not listed in the CISA Known Exploited Vulnerabilities catalog, but the attack vector\u2014uploading a malicious .ovpack\u2014can be performed in environments where users can import packages. A successful exploit would allow an attacker to write arbitrary files with the privileges of the importing process, which may include root or system-level rights."}}}}, "created": "2026-03-04T14:54:15.041092+00:00", "updated": "2026-04-16T06:00:10.113350+00:00", "vendors": ["volcengine", "volcengine$PRODUCT$openviking"]}