PT-2026-53917 · Openbb · Chatdev

George Chen · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58166

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBMB ChatDev versions prior to commit 4fd4da6

Description An unauthenticated remote attacker can write or delete arbitrary files on the server filesystem. The issue occurs because the application fails to sanitize the multipart filename provided to the 'POST uploads session' endpoint. Specifically, the save upload file() function constructs the destination path without proper validation, allowing the use of absolute paths or path traversal sequences (such as ../) to target files outside the intended directory. This can lead to the overwriting or removal of critical system and application files, potentially resulting in a denial of service.

Recommendations Update OpenBMB ChatDev to commit 4fd4da6 or a subsequent release containing this fix.

Exploit

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-58166

Affected Products

Chatdev

References · 6

• 🔥 https://github.com/OpenBMB/ChatDev/issues/638 · Exploit
• https://github.com/OpenBMB/ChatDev/commit/4fd4da603801766b14ad8788649cfc1ad21f99a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58166 · Security Note
• https://github.com/OpenBMB/ChatDev/pull/641 · Note
• https://vulncheck.com/advisories/openbmb-chatdev-unauthenticated-path-traversal-in-upload-handler-allows-arbitrary-file-write-and-delete · Note
• https://twitter.com/UpwindMDR/status/2072017223481237965 · Twitter Post