CVE-2026-28795

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language conversations. Prior to version 0.2.2, the save_report tool in openchatbi/tool/save_report.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the file_format parameter. This issue has been patched in version 0.2.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
zhongyu09	openchatbi	< 0.2.2

References

https://github.com/zhongyu09/openchatbi/commit/372a7e861da5159c3106d64d6f6edf8284db8c75Patch
https://github.com/zhongyu09/openchatbi/issues/10Issue Tracking
https://github.com/zhongyu09/openchatbi/pull/12Issue Tracking, Patch
https://github.com/zhongyu09/openchatbi/security/advisories/GHSA-vmwq-8g8c-jm79Patch, Vendor Advisory

Timeline

Published: Mar 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-287978.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI)CVE-2026-2879810.0ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1 CVE-2026-287997.5PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability ex CVE-2026-28809.1A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for CVE-2026-288008.0Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control se CVE-2026-288017.8Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pa CVE-2026-288029.8Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involv CVE-2026-288036.5Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail wit CVE-2026-288045.3pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF whi CVE-2026-288058.8OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select h CVE-2026-288068.8Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and devic CVE-2026-288077.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read v