Vulnerability · Published Mar 3, 2026 · Assigned by VulnCheck

CVE-2026-28518OpenViking .ovpack Import ZIP Slip Path Traversal

High 7.8

In plain English

A high-severity path traversal in OpenViking from Volcengine. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 89.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names to overwrite or create arbitrary files with the importing process privileges.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	openviking	no fix listed	GHSA-rpqr-j937-6qr9
PyPI	openviking	no fix listed	PYSEC-2026-2856

Affected products (as reported)

Vendor	Product	Versions
Volcengine	OpenViking	0 – through 0.2.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/volcengine/OpenViking/issues/342 issue-tracking
https://github.com/volcengine/OpenViking/commit/46b3e76e28b9b3eee73693720c9ec48820228b72 patch
https://www.vulncheck.com/advisories/openviking-ovpack-import-zip-slip-path-traversal third-party-advisory