Is CVE-2026-28482 actively exploited?

No active exploitation of CVE-2026-28482 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-28482 be exploited remotely?

No. CVE-2026-28482 requires local access to exploit.

What is the CVSS score of CVE-2026-28482?

CVE-2026-28482 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-28482

HIGH

CVE-2026-28482

CWE-22Published: March 5, 2026· Updated: Mar 9, 2026

7.1

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:3.3th

Official Description

OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences like ../../etc/passwd in sessionId or sessionFile parameters to read or write arbitrary files outside the agent sessions directory.

NVD Source

Technical Analysis

CVE-2026-28482 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 7.1.