OpenChatBI heeft een Path Traversal Vulnerability in de save_report Tool

The core issue lies in the insufficient sanitization of the fileformat parameter within the savereport.py script. While leading dots are stripped, malicious path traversal sequences like /../../ are not adequately handled. Consequently, when constructing the filename, these sequences are preserved, enabling attackers to bypass intended directory restrictions. An attacker could leverage this to overwrite critical system files, inject malicious code, or gain unauthorized access to sensitive data. The potential impact extends beyond simple file manipulation; successful exploitation could lead to complete system compromise.

Organizations deploying openchatbi, particularly those using older versions (≤0.2.1) or those with insufficient file access controls, are at significant risk. Shared hosting environments where multiple users have write access to the same directory are especially vulnerable.

• python / file system:

import os
import glob

report_dir = '/path/to/openchatbi/reports'
pattern = os.path.join(report_dir, '*.*')

# Check for unexpected files outside the report directory
for file in glob.glob(pattern):
    if not file.startswith(report_dir): # Basic check - refine as needed
        print(f"Potential path traversal: {file}")

• generic web:

curl 'http://your-openchatbi-instance/tool/save_report?file_format=../../../../etc/passwd' -s | grep 'etc/passwd'

1. 2026-03-02Disclosure

   disclosure

1. Gereserveerd2026-03-03
2. Gepubliceerd2026-03-02
3. Gewijzigd2026-03-06
4. EPSS bijgewerkt2026-03-23

The primary mitigation is to upgrade to openchatbi version 0.2.2 or later, which includes the necessary input sanitization fixes. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal sequences in the file_format parameter. Additionally, restrict write access to the report directory to only the necessary user accounts. Regularly review and audit the application's file handling logic to identify and address potential vulnerabilities.