CVE-2026-28518: OpenViking Path Traversal Vulnerability
Summary
CVE-2026-28518: OpenViking contains a Path Traversal vulnerability. Affects openviking versions < 0.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenViking is an open-source software package available on PyPI that facilitates the import and management of .ovpack files. It is designed to streamline the handling of various file formats, providing users with a straightforward interface for file manipulation. However, certain versions of OpenViking are susceptible to a path traversal vulnerability, which can lead to unauthorized file access and manipulation.
Vulnerability Detail
OpenViking versions 0.2.1 and earlier contain a path traversal vulnerability in the .ovpack import handling. This flaw allows attackers to craft malicious ZIP archives that include traversal sequences, absolute paths, or drive prefixes in member names. Consequently, this can enable attackers to overwrite or create arbitrary files with the privileges of the importing process, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid importing .ovpack files from untrusted sources. Additionally, consider implementing file system permissions that restrict the ability of the importing process to write to sensitive directories.
Conclusion
The path traversal vulnerability in OpenViking poses a significant risk to users, allowing potential unauthorized file access and manipulation. It is crucial for users to update to the patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for openviking →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized data exposure or manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to overwrite critical files, leading to data loss, application malfunction, or unauthorized access to sensitive information.
Yes, the vulnerability has been fixed in OpenViking version 0.2.2. Users are advised to upgrade to this version or later.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openviking.
