What’s Vulnerable › Vulnerabilities

CVE-2026-28795: OpenChatBI: Critical Path Traversal Vulnerability in save_report Tool of OpenChatBI

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-06 · updated 2026-06-17
• Weakness: CWE-22

Description

OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language conversations. Prior to version 0.2.2, the save_report tool in openchatbi/tool/save_report.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the file_format parameter. This issue has been patched in version 0.2.2.

Affected products

• zhongyu09 openchatbi: before 0.2.2 — fixed in 0.2.2

How to fix

Upgrade to a fixed version: zhongyu09 openchatbi 0.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/zhongyu09/openchatbi/commit/372a7e861da5159c3106d64d6f6edf8284db8c75
• https://github.com/zhongyu09/openchatbi/issues/10
• https://github.com/zhongyu09/openchatbi/pull/12
• https://github.com/zhongyu09/openchatbi/security/advisories/GHSA-vmwq-8g8c-jm79

Get alerted when CVE-2026-28795 or the next vulnerability affects your stack