OpenChatBI has a Path Traversal Vulnerability in save_report Tool
Impact
The save_report tool in openchatbi/tool/save_report.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the file_format parameter.
The function only removes leading dots of file_format using file_format.lstrip(".") but allows path traversal sequences like /../../ to pass through unchanged. When the filename is constructed via string concatenation in
f"{timestamp}_{clean_title}.{file_format}"malicious path sequences are preserved, enabling attackers to write files outside the designated report directory.
An attacker can manipulate the LLM to call the tool with a specific file_format to overwrite critical system files like __init__.py, potentially leading to remote code execution.
Patches
- Affected versions: <=0.2.1
- Patched versions: 0.2.2 (includes fix from PR #12: https://github.com/zhongyu09/openchatbi/pull/12)
Workarounds
No
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | openchatbi | < 0.2.2 | 0.2.2 |
References
- https://github.com/zhongyu09/openchatbi/security/advisories/GHSA-vmwq-8g8c-jm79
- https://nvd.nist.gov/vuln/detail/CVE-2026-28795
- https://github.com/zhongyu09/openchatbi/issues/10
- https://github.com/zhongyu09/openchatbi/pull/12
- https://github.com/zhongyu09/openchatbi/commit/372a7e861da5159c3106d64d6f6edf8284db8c75
- https://github.com/zhongyu09/openchatbi
- https://pypi.org/project/openchatbi
- https://github.com/advisories/GHSA-vmwq-8g8c-jm79
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-22- Platform
- Python (PyPI)
- Package
openchatbi- Disclosed
- 02.03.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2794 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vmwq-8g8c-jm79 - CC BY 4.0
Vulnerability history: openchatbi
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.