Path Traversal in OpenBMB ChatDev

Executive Summary

CVE-2026-58166 is a path traversal vulnerability in OpenBMB ChatDev versions up to 2.2.0. It occurs in the file upload handler where the application fails to properly sanitize filenames supplied in multipart upload requests.

Attackers can supply malicious filenames containing path traversal sequences (like ../../../) or absolute paths to the upload endpoint. Because the server constructs the destination file path without validation, this allows attackers to write or delete arbitrary files anywhere on the server filesystem.

The vulnerable endpoint is the POST /api/uploads/{session_id}, which requires only a session ID that can be obtained without authentication. This means unauthenticated remote attackers can exploit this flaw.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to write or delete arbitrary files on the server hosting OpenBMB ChatDev. This can lead to serious impacts including:

• Overwriting critical system files such as shell configuration files or cron jobs, potentially enabling remote code execution.
• Deleting important files on the host system, which can disrupt service or cause data loss.
• Compromising the integrity and availability of the server by manipulating files outside the intended upload directory.

Useful 0 Not Useful 0