CVE-2026-58166 Details
Description
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in save_upload_file, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem.
A path traversal vulnerability has been identified in OpenBMB ChatDev versions through 2.2.0. This vulnerability allows unauthenticated remote attackers to write or delete arbitrary files by sending a malicious multipart filename to the file upload endpoint. The vulnerability arises because the upload filename is not properly sanitized, enabling attackers to exploit path traversal sequences or absolute paths. The issue has been confirmed by demonstrating that an uploaded file could overwrite a victim file outside the temporary directory used for uploads.
Users are advised to update to OpenBMB ChatDev version 2.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenBMB/ChatDev/commit/4fd4da603801766b14ad8788649cfc1ad21f99a6 | [email protected] | Source CodeVendor |
| https://github.com/OpenBMB/ChatDev/issues/638 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/OpenBMB/ChatDev/pull/641 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/openbmb-chatdev-unauthenticated-path-traversal-in-upload-handler-allows-arbitrary-file-write-and-delete | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenBMB ChatDev | <= 2.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |