CVE-2026-58166: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in OpenBMB ChatDev
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in save_upload_file, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem.
AI Analysis
Technical Summary
CVE-2026-58166 is a path traversal vulnerability in OpenBMB ChatDev through version 2.2.0. The issue occurs in the file upload endpoint where the application constructs the destination file path without proper sanitization of the multipart filename. Attackers can exploit this by sending a malicious filename containing path traversal sequences or absolute paths, allowing them to write or delete arbitrary files on the server filesystem. This vulnerability is exploitable without authentication and has a CVSS 3.1 base score of 9.1, indicating critical severity. The vulnerability was fixed in a commit referenced as 4fd4da6.
Potential Impact
An unauthenticated remote attacker can leverage this vulnerability to write or delete arbitrary files on the server hosting OpenBMB ChatDev. This can lead to significant integrity and availability impacts, including potential disruption of service or unauthorized modification of server files. Confidentiality impact is not indicated. The high CVSS score reflects the ease of exploitation and the severity of the impact on integrity and availability.
Mitigation Recommendations
A fix for this vulnerability is available and was introduced in the commit identified as 4fd4da6. Users should upgrade OpenBMB ChatDev to a version that includes this fix. Since no official patch version number is provided, users must refer to the vendor's repository or advisory to apply the fix. Until patched, restricting access to the upload endpoint and monitoring for suspicious upload activity may reduce risk but do not fully mitigate the vulnerability.
CVE-2026-58166: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in OpenBMB ChatDev
Description
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in save_upload_file, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem.
CVSS v3.1
Score 9.1critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58166 is a path traversal vulnerability in OpenBMB ChatDev through version 2.2.0. The issue occurs in the file upload endpoint where the application constructs the destination file path without proper sanitization of the multipart filename. Attackers can exploit this by sending a malicious filename containing path traversal sequences or absolute paths, allowing them to write or delete arbitrary files on the server filesystem. This vulnerability is exploitable without authentication and has a CVSS 3.1 base score of 9.1, indicating critical severity. The vulnerability was fixed in a commit referenced as 4fd4da6.
Potential Impact
An unauthenticated remote attacker can leverage this vulnerability to write or delete arbitrary files on the server hosting OpenBMB ChatDev. This can lead to significant integrity and availability impacts, including potential disruption of service or unauthorized modification of server files. Confidentiality impact is not indicated. The high CVSS score reflects the ease of exploitation and the severity of the impact on integrity and availability.
Mitigation Recommendations
A fix for this vulnerability is available and was introduced in the commit identified as 4fd4da6. Users should upgrade OpenBMB ChatDev to a version that includes this fix. Since no official patch version number is provided, users must refer to the vendor's repository or advisory to apply the fix. Until patched, restricting access to the upload endpoint and monitoring for suspicious upload activity may reduce risk but do not fully mitigate the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-29T16:03:38.521Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a43f42f27e9c79719185edc
Added to database: 06/30/2026, 16:51:59 UTC
Last enriched: 07/16/2026, 09:19:06 UTC
Last updated: 08/12/2026, 12:41:10 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.