CVE-2026-58166: Openbmb Chatdev

Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days.

OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in save_upload_file, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem.

Affected products

• Openbmb Chatdev: up to and including 2.2.0

Published 2026-06-30. Last modified 2026-07-14.