OpenChatBI hat eine Path Traversal Vulnerability im Tool `save_report`.

The vulnerability lies within the savereport tool, specifically in how it handles the fileformat parameter. Insufficient sanitization allows attackers to craft malicious filenames containing path traversal sequences like /../../. When the filename is constructed, these sequences are preserved, enabling attackers to write files to arbitrary locations on the server's file system. This could allow for overwriting critical system files, injecting malicious code, or exfiltrating sensitive data. The potential impact is significant, as an attacker could gain complete control over the server's file system.

Organizations deploying openchatbi, particularly those using older versions (≤0.2.1) or those with insufficient file access controls, are at significant risk. Shared hosting environments where multiple users have write access to the same directory are especially vulnerable.

• python / file system:

import os
import glob

report_dir = '/path/to/openchatbi/reports'
pattern = os.path.join(report_dir, '*.*')

# Check for unexpected files outside the report directory
for file in glob.glob(pattern):
    if not file.startswith(report_dir): # Basic check - refine as needed
        print(f"Potential path traversal: {file}")

• generic web:

curl 'http://your-openchatbi-instance/tool/save_report?file_format=../../../../etc/passwd' -s | grep 'etc/passwd'

1. 2026-03-02Disclosure

   disclosure

1. Reserviert2026-03-03
2. Veröffentlicht2026-03-02
3. Geändert2026-03-06
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to openchatbi version 0.2.2 or later, which includes the necessary input sanitization fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences in the file_format parameter. Additionally, restrict write access to the report directory to only the necessary user accounts and processes. Regularly review file system permissions and audit logs for any suspicious activity.