https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:46:36 +0000 https://vulnerability.circl.lu/vuln/cve-2026-28795 <p><strong>Affected:</strong> zhongyu09 openchatbi</p> <p>OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language conversations. Prior to version 0.2.2, the save_report tool in openchatbi/tool/save_report.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the file_format parameter. This issue has been patched in version 0.2.2.</p> <p><strong>Affected:</strong> zhongyu09 openchatbi</p> <p>OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language conversations. Prior to version 0.2.2, the save_report tool in openchatbi/tool/save_report.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the file_format parameter. This issue has been patched in version 0.2.2.</p> https://vulnerability.circl.lu/vuln/cve-2026-28795 https://vulnerability.circl.lu/vuln/pysec-2026-2794 <p><strong>Affected:</strong> PyPI: openchatbi</p> <p>### Impact The `save_report` tool in `openchatbi/tool/save_report.py` suffers from a critical path traversal vulnerability due to insufficient input sanitization of the `file_format` parameter.</p> <p>The function only removes leading dots of `file_format` using `file_format.lstrip(&#34;.&#34;)` but allows path traversal sequences like `/../../` to pass through unchanged. When the filename is constructed via string concatenation in</p> <p>f&#34;{timestamp}_{clean_title}.{file_format}&#34;</p> <p>malicious path sequences are preserved, enabling attackers to write files outside the designated report directory.</p> <p>An attacker can manipulate the LLM to call the tool with a specific `file_format` to overwrite critical system files like `__init__.py`, potentially leading to remote code execution.</p> <p>### Patches - Affected versions: &lt;=0.2.1 - Patched versions: 0.2.2 (includes fix from PR #12: https://github.com/zhongyu09/openchatbi/pull/12)</p> <p>### Workarounds No</p> <p>### References - Issue #10: https://github.com/zhongyu09/openchatbi/issues/10 - PR #12: https://github.com/zhongyu09/openchatbi/pull/12</p> <p><strong>Affected:</strong> PyPI: openchatbi</p> <p>### Impact The `save_report` tool in `openchatbi/tool/save_report.py` suffers from a critical path traversal vulnerability due to insufficient input sanitization of the `file_format` parameter.</p> <p>The function only removes leading dots of `file_format` using `file_format.lstrip(&#34;.&#34;)` but allows path traversal sequences like `/../../` to pass through unchanged. When the filename is constructed via string concatenation in</p> <p>f&#34;{timestamp}_{clean_title}.{file_format}&#34;</p> <p>malicious path sequences are preserved, enabling attackers to write files outside the designated report directory.</p> <p>An attacker can manipulate the LLM to call the tool with a specific `file_format` to overwrite critical system files like `__init__.py`, potentially leading to remote code execution.</p> <p>### Patches - Affected versions: &lt;=0.2.1 - Patched versions: 0.2.2 (includes fix from PR #12: https://github.com/zhongyu09/openchatbi/pull/12)</p> <p>### Workarounds No</p> <p>### References - Issue #10: https://github.com/zhongyu09/openchatbi/issues/10 - PR #12: https://github.com/zhongyu09/openchatbi/pull/12</p> https://vulnerability.circl.lu/vuln/pysec-2026-2794