CVE-2026-58166: OpenBMB ChatDev Path Traversal Flaw

CVE-2026-58166 Overview

CVE-2026-58166 is an unauthenticated path traversal vulnerability [CWE-22] in OpenBMB ChatDev through version 2.2.0. The flaw resides in the file upload handler, which constructs destination paths from attacker-controlled multipart filename values without sanitization. Remote attackers can supply crafted filenames containing traversal sequences such as ../../../ or absolute paths to the POST uploads session endpoint. The save_upload_file function then writes and later deletes files at attacker-chosen locations on the server filesystem. The issue is fixed in commit 4fd4da6.

Critical Impact
Unauthenticated remote attackers can write or delete arbitrary files on the ChatDev host, enabling code execution paths through overwriting configuration files, cron jobs, or application binaries.

Affected Products

OpenBMB ChatDev versions through 2.2.0
ChatDev deployments exposing the upload session endpoint
Fixed in commit 4fd4da603801766b14ad8788649cfc1ad21f99a6

Discovery Timeline

2026-06-30 - CVE-2026-58166 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58166

Vulnerability Analysis

The vulnerability affects the save_upload_file method in server/services/attachment_service.py. The handler reads the filename attribute directly from the incoming UploadFile object and joins it onto a temporary upload directory using Path concatenation. Because the multipart filename field is attacker-controlled, supplying a value such as ../../../etc/cron.d/x causes the resolved write target to escape the intended temp directory. The subsequent cleanup routine calls unlink on the same traversed path, giving attackers both arbitrary file write and arbitrary file delete primitives.

Root Cause

The root cause is missing input sanitization on the client-supplied multipart filename. The pre-patch code fell back to "upload.bin" only when upload.filename was empty, but performed no basename extraction or separator normalization. Both POSIX (/) and Windows (\) path separators passed through unchanged.

Attack Vector

An unauthenticated attacker sends a POST request to the uploads session endpoint with a multipart body whose filename parameter contains traversal sequences or an absolute path. The endpoint accepts the request without authentication, and the server writes the uploaded content to the traversed location using the privileges of the ChatDev process.

python

# Patch from commit 4fd4da6 - server/services/attachment_service.py
@staticmethod
def _safe_upload_filename(raw: Optional[str]) -> str:
    """Reduce a client-supplied upload filename to a safe basename.

    The multipart ``filename`` is attacker-controlled. Joining it onto the
    temporary upload directory verbatim allows path traversal (e.g.
    ``../../../etc/cron.d/x``): the write target escapes the temp dir and the
    cleanup step then unlinks the same traversed path, yielding arbitrary
    file write and delete. Normalise both POSIX and Windows separators and
    keep only the final path component so the write stays confined.
    """
    candidate = os.path.basename((raw or "").replace("\\", "/")).strip()
    if not candidate or candidate in {".", ".."}:
        return "upload.bin"
    return candidate

async def save_upload_file(self, session_id: str, upload: UploadFile) -> AttachmentRecord:
    filename = self._safe_upload_filename(upload.filename)
    temp_dir = Path(tempfile.mkdtemp(prefix="mac_upload_"))
    temp_path = temp_dir / filename

Source: GitHub Commit 4fd4da6. The fix normalizes separators, applies os.path.basename, and rejects . or .. values.

Detection Methods for CVE-2026-58166

Indicators of Compromise

POST requests to the ChatDev uploads session endpoint containing multipart filenames with ../, ..\\, or leading / characters
Unexpected files appearing outside the mac_upload_ temporary directory prefix
Modifications to sensitive paths such as /etc/cron.d/, ~/.ssh/authorized_keys, or web application source directories on ChatDev hosts
Missing or deleted files in ChatDev workspace directories following upload activity

Detection Strategies

Inspect HTTP access logs for multipart uploads containing encoded traversal patterns (%2e%2e%2f, ..%2f) in the filename disposition
Deploy file integrity monitoring on system directories writable by the ChatDev service account
Correlate ChatDev upload endpoint requests with subsequent filesystem events outside expected workspace paths

Monitoring Recommendations

Alert on any write or unlink syscalls issued by the ChatDev process against paths outside its designated workspace
Monitor for new or modified scheduled tasks, systemd units, and startup scripts on hosts running ChatDev
Log and review all HTTP requests to the uploads endpoint, including full multipart headers

How to Mitigate CVE-2026-58166

Immediate Actions Required

Upgrade OpenBMB ChatDev to the version containing commit 4fd4da6 or later
Restrict network access to the ChatDev uploads endpoint using firewall rules or reverse proxy authentication until patching is complete
Audit the ChatDev host for unauthorized file writes or deletions in system and configuration directories

Patch Information

The fix is available in commit 4fd4da6, merged via pull request #641 which addresses issue #638. Refer to the VulnCheck advisory for additional context. Apply the _safe_upload_filename helper that normalizes separators and enforces basename extraction.

Workarounds

Run ChatDev under a dedicated low-privilege user account with write access limited to its workspace directory
Deploy a reverse proxy filter that rejects multipart requests whose filename fields contain .., /, or \\ characters
Place the ChatDev process inside a container or chroot with read-only bind mounts covering sensitive host paths

bash

# Nginx filter example rejecting traversal in multipart filenames
location /uploads/ {
    if ($request_body ~* "filename=\"[^\"]*(\.\.[\\/]|^/)") {
        return 400;
    }
    proxy_pass http://chatdev_backend;
}