QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-28518

Back to search

CVE-2026-28518

Published: Mar 3, 2026

Modified: May 25, 2026

PUBLISHED

CVSS v3.1

7.8

HIGH

Description

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.

VendorProductVersions

Volcengine

OpenViking

affected
0 - <= 0.2.1
unaffected
46b3e76e28b9b3eee73693720c9ec48820228b72

Weaknesses (CWE)

CWE-22

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now