NVD CRITICAL: CVE-2026-58166 — OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversa...
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs th
CVE-2026-58166