CRITICALVulnerability
Verified
Global
NVD CRITICAL: CVE-2026-58166 — OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversa...
·Source: NIST NVD
Updated:
Executive Summary
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs th
Analysis
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in save_upload_file, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem. CVSS Score: 9.1. Published: 2026-06-30T17:16:23.487.