Critical Path Traversal in OpenBMB ChatDev Enables Unauthenticated File Write and Delete

OpenBMB ChatDev through version 2.2.0 is affected by CVE-2026-58166, a critical unauthenticated path traversal flaw in its file upload handler that lets remote attackers write or delete arbitrary files on the server. The vulnerability stems from the POST uploads session endpoint, where a malicious multipart filename containing traversal sequences or an absolute path is passed into save_upload_file without proper sanitization, allowing attacker-controlled filesystem paths to be used during upload and cleanup operations.

The issue is rated CVSS 3.1 9.1 (Critical), with a listed CVSS 4.0 8.8 (High), and is considered remotely exploitable without authentication. The flaw was fixed in commit 4fd4da6, and affected organizations should update to a patched release and enforce strict validation and sanitization of upload filenames and paths to prevent arbitrary file write or deletion.