OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to wri…

OpenViking versions 0.2.1 and prior contain a path traversal vulnerability (CVE-2026-28518) in the .ovpack import handling functionality. The vulnerability allows attackers to write files outside the intended import directory by crafting malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes in member names. This enables attackers to overwrite or create arbitrary files with the privileges of the importing process. The issue has been fixed in commit 46b3e76.