CVE-2026-28518: 
Python vulnerability analysis and mitigation

CVE-2026-28518 is a path traversal (ZIP Slip) vulnerability in OpenViking, an open-source AI framework developed by Volcengine. Affecting versions 0.2.1 and prior, the flaw exists in the .ovpack import handling and allows attackers to write files outside the intended import directory by crafting malicious ZIP archives. It was reported on February 28, 2026 via GitHub Issue #342 and publicly disclosed on March 3, 2026, with a fix committed on April 17, 2026. The vulnerability carries a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.4 (High) (VulnCheck Advisory, GitHub Issue).

The root cause is improper input validation (CWE-22: Path Traversal) in the import_ovpack function within openviking/storage/local_fs.py. The function failed to uniformly validate ZIP archive member names before performing file write operations, allowing entries with ../ traversal sequences, absolute paths (e.g., /abs/path.txt), Windows drive prefixes (e.g., C:\evil.txt), or backslash separators to be processed. An attacker crafts a malicious .ovpack file (which is a ZIP container) with such entries; when a victim imports this archive, files are written to arbitrary filesystem locations with the privileges of the importing process. The fix (commit 46b3e76) introduced a _validate_ovpack_member_path() function that rejects all unsafe path patterns before any write or mkdir operation is performed (GitHub Commit, GitHub Issue).

Successful exploitation allows an attacker to overwrite or create arbitrary files on the victim's filesystem with the privileges of the process running the OpenViking import operation. This can lead to high confidentiality, integrity, and availability impacts — for example, overwriting configuration files, injecting malicious scripts, or corrupting application data. Because exploitation requires the victim to actively import a malicious .ovpack file (user interaction required), the attack vector is local, but the consequences can include privilege escalation or persistent code execution if sensitive files such as startup scripts or application binaries are overwritten (VulnCheck Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-28518. The EPSS score is approximately 0.006% (0.000060), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must be socially engineered into importing a malicious .ovpack archive — which limits opportunistic exploitation (VulnCheck Advisory).

1. Craft a malicious .ovpack archive: Create a ZIP file containing entries with path traversal sequences, such as pkg/../../escape.txt, absolute paths like /etc/cron.d/backdoor, Windows drive prefixes like C:\Windows\System32\evil.dll, or entries with backslash separators.
2. Embed a legitimate-looking metadata entry: Include a valid _._meta.json entry (e.g., pkg/_._meta.json with content {"uri": "viking://resources/pkg"}) to make the archive appear legitimate.
3. Deliver the malicious archive: Distribute the crafted .ovpack file to a target user via email, file sharing, or a compromised package repository, disguising it as a legitimate OpenViking resource package.
4. Trigger import: Convince the victim to import the archive using import_ovpack() or the OpenViking CLI. The vulnerable code processes archive entries without validating paths, writing files to attacker-controlled locations.
5. Achieve objective: Depending on the target path chosen, the attacker can overwrite startup scripts, inject web shells, corrupt application files, or plant malicious binaries — all executed with the privileges of the importing process (GitHub Issue, GitHub Commit).

• File System: Unexpected files appearing outside the intended OpenViking import directory (e.g., in parent directories, /tmp, /etc, home directories, or system paths); files with names matching traversal patterns such as escape.txt or other anomalous filenames in unexpected locations.
• Logs: Application or system logs showing ValueError exceptions related to Unsafe ovpack entry path or Invalid ovpack entry root (on patched versions detecting an attack attempt); Python tracebacks from openviking/storage/local_fs.py during import operations.
• Process: Unexpected file write operations by the Python process running OpenViking to directories outside the designated import path, observable via file integrity monitoring tools (e.g., auditd, inotify).
• Network: Receipt of unsolicited .ovpack files from external sources; downloads of .ovpack archives from untrusted or newly registered domains (GitHub Issue).

Users should upgrade OpenViking to a version incorporating commit 46b3e76 (merged via PR #344), which introduces strict path validation in _validate_ovpack_member_path() that rejects traversal sequences, absolute paths, drive prefixes, and backslash separators before any file operation. As a workaround for those unable to upgrade immediately, avoid importing .ovpack archives from untrusted or unverified sources. Organizations can also implement file integrity monitoring on directories used by OpenViking to detect unauthorized writes (GitHub Commit, VulnCheck Advisory).

The vulnerability was assigned and disclosed by VulnCheck, which published a dedicated advisory. The issue was originally reported by community researcher 13ernkastel via the OpenViking GitHub repository. Social media activity was limited, with brief mentions on Bluesky and automated CVE notification accounts. No major media coverage or significant researcher commentary beyond the initial disclosure has been identified (VulnCheck Advisory, GitHub Issue).