CVE-2026-28518highCWE-22

CVE-2026-28518: high-severity vulnerability in Volcengine OpenViking

OpenViking .ovpack Import ZIP Slip Path Traversal

Published · Updated

Follow this CVE+ Monitor OpenViking+ Monitor openviking

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 0.2%
OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Volcengine · OpenViking
Related CVEs — Volcengine OpenViking

In the same product, most dangerous first.

CVE-2026-22207CRITICALOpenViking Missing root_api_key Allows Anonymous ROOT AccessEPSS 0.5%CVE-2026-34999MEDIUMOpenViking 0.2.5 < 0.2.14 Bot Proxy Endpoints Allow Unauthenticated AccessEPSS 0.4%CVE-2026-22680MEDIUMOpenViking < 0.3.3 Missing Authorization via Task PollingEPSS 0.4%CVE-2026-22681HIGHOpenViking < 0.3.4 SSRF via /api/v1/resourcesEPSS 0.3%