CVE-2026-58166 is a path traversal vulnerability in OpenBMB ChatDev (<=2.2.0) that permits unauthenticated remote attackers to write or delete arbitrary files on the server filesystem. The vulnerability occurs in the file upload endpoint where the application constructs the destination path from a multipart filename without sanitization, allowing attackers to use path traversal sequences or absolute paths. This enables manipulation of files outside the restricted directory, potentially impacting system integrity and availability. The issue is resolved in a later commit (4fd4da6).

Exploitation of this vulnerability can lead to arbitrary file write and deletion on the server hosting OpenBMB ChatDev, potentially allowing attackers to modify or remove critical files. This can result in denial of service or further compromise of the server environment. The vulnerability requires no authentication and has a low attack complexity, making it highly dangerous.

A fix for this vulnerability is available and was introduced in commit 4fd4da6. Users should upgrade OpenBMB ChatDev to a version that includes this fix. Until patched, restrict access to the file upload endpoint and monitor for suspicious activity related to file uploads. Patch status is not explicitly confirmed in a vendor advisory; therefore, verify the fix by applying the commit or an official update from the vendor.