Executive brief
OpenBMB ChatDev, a platform for AI-driven software development, contains a security flaw in its file upload system. An unauthenticated attacker can exploit this to write or delete any file on the server's filesystem. This could lead to a complete system takeover by overwriting critical configuration files or a total loss of data through arbitrary file deletion.
Technical details
A path traversal vulnerability exists in the `save_upload_file` function within `server/services/attachment_service.py`. The application fails to sanitize the client-provided multipart filename before joining it with a temporary directory path. An unauthenticated attacker can send a POST request to the `/api/uploads/{session_id}` endpoint with a filename containing traversal sequences (e.g., `../../`). This causes the application to write uploaded content to an arbitrary location and subsequently delete the same file during the `finally` cleanup block's `unlink()` operation. The vulnerability is exploitable without authentication as session IDs are minted freely by the workflow server. A fix is available in commit 4fd4da6.
Affected products
- OpenBMB ChatDev through 2.2.0
Timeline
- 2026-06-12: disclosed: Issue reported to vendor via GitHub
- 2026-06-29: patched: Fix merged in commit 4fd4da6
- 2026-06-30: advisory: CVE-2026-58166 published
References
- https://github.com/OpenBMB/ChatDev/commit/4fd4da603801766b14ad8788649cfc1ad21f99a6
- https://github.com/OpenBMB/ChatDev/issues/638
- https://github.com/OpenBMB/ChatDev/pull/641
- https://www.vulncheck.com/advisories/openbmb-chatdev-unauthenticated-path-traversal-in-upload-handler-allows-arbitrary-file-write-and-delete