EUVD-2026-40373
GHSA-hh77-fhmp-pqfv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-request upload to a network endpoint gives AV:N/AC:L/PR:N/UI:N; arbitrary write/delete is I:H/A:H with no file read, so C:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in save_upload_file, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem.
AnalysisAI
Arbitrary file write and delete in OpenBMB ChatDev through 2.2.0 lets unauthenticated remote attackers control destination paths on the server by abusing the multipart filename in the upload session endpoint. Because save_upload_file joins the attacker-supplied filename onto the temp directory without sanitization, a traversal or absolute-path filename redirects both the write and the subsequent cleanup unlink to arbitrary host locations. Publicly available exploit code exists and a vendor fix is available (commit 4fd4da6); there is no public exploit identified as actively exploited in CISA KEV at time of analysis.
Technical ContextAI
ChatDev is OpenBMB's open-source multi-agent LLM framework for collaborative software development; the affected component is its FastAPI-based attachment/upload handler (server/services/attachment_service.py). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the multipart 'filename' field is fully attacker-controlled, yet AttachmentService.save_upload_file used 'upload.filename or "upload.bin"' and joined it directly onto a freshly created temp directory. A filename such as '../../../etc/cron.d/x' or an absolute path '/abs/path/secret.key' escapes the intended temp/WareHouse area, so the file-write operation lands on an attacker-chosen path and the cleanup step's unlink then deletes that same traversed path. The fix introduces _safe_upload_filename, which normalizes both POSIX and Windows separators and reduces the input to its final basename (falling back to 'upload.bin' for empty, '.', or '..').
RemediationAI
Upgrade to a ChatDev build that includes the fix commit 4fd4da603801766b14ad8788649cfc1ad21f99a6 (merged via PR https://github.com/OpenBMB/ChatDev/pull/641); since the upstream fix is a tagged commit/PR rather than a clearly named release, treat 'Upstream fix available (commit/PR); released patched version not independently confirmed' and pin to or beyond that commit. If you cannot patch immediately, do not expose the upload session endpoint to untrusted networks: restrict access to the POST uploads endpoint via authentication, a reverse-proxy allowlist, or network segmentation (trade-off: breaks remote/multi-user upload workflows), and run ChatDev under a low-privilege service account on a filesystem where the process cannot write to sensitive paths such as cron directories, web roots, or application source (trade-off: requires careful permission hardening and may interrupt legitimate file handling). As a code-level workaround mirroring the official fix, normalize the multipart filename to its basename before joining it to the storage directory. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/openbmb-chatdev-unauthenticated-path-traversal-in-upload-handler-allows-arbitrary-file-write-and-delete) for details.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today