Loading story…
OpenBMB ChatDev through version 2.2.0 is affected by CVE-2026-58166, a critical unauthenticated path traversal flaw in its file upload handler that lets remote attackers write or delete arbitrary files on the server. The vulnerability stems from the POST uploads session endpoint, where a malicious multipart filename containing traversal sequences or an absolute path is passed into save_upload_file without proper sanitization, allowing attacker-controlled filesystem paths to be used during upload and cleanup operations.
The issue is rated CVSS 3.1 9.1 (Critical), with a listed CVSS 4.0 8.8 (High), and is considered remotely exploitable without authentication. The flaw was fixed in commit 4fd4da6, and affected organizations should update to a patched release and enforce strict validation and sanitization of upload filenames and paths to prevent arbitrary file write or deletion.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
A path traversal vulnerability in OpenBMB ChatDev's upload handler, affecting versions through 2.2.0, was fixed in commit 4fd4da6. The flaw allowed unauthenticated remote attackers to write or delete arbitrary files via a malicious multipart filename sent to the upload endpoint.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **`CVE-2026-19264`** affects **Postiz**, the open-source social media scheduling platform, allowing unauthenticated attackers to read arbitrary files through the `/uploads` route by exploiting path traversal with URL-encoded separators. The flaw stems from unsafe joining of user-controlled path segments to the configured upload directory without proper normalization or confinement, enabling access to sensitive files available to the application process. The issue is rated **CVSS 9.8** and is classified as **CWE-22**. Exposure of environment files can reveal the **JWT signing secret**, database credentials, and third-party provider or billing secrets, creating a path to full instance compromise. Because Postiz uses signed session tokens with no expiry, attackers who obtain the JWT secret can forge persistent sessions for any account, including administrators, effectively taking over the instance. The vulnerability affects **`postiz-app` versions earlier than `2.22.1`**; a fix was introduced in commit **`7936062`**, which resolves file paths, verifies they remain inside the upload directory, and rejects out-of-scope requests.
Aug 7, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026