Description
OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in save_upload_file, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenBMB ChatDev
Default version status: affected
0 to ≤ 2.2.0affected4fd4da603801766b14ad8788649cfc1ad21f99a6unaffected
pkg:github/OpenBMB/ChatDevReferences
- https://github.com/OpenBMB/ChatDev/issues/638 ↗
- https://github.com/OpenBMB/ChatDev/pull/641 ↗
- https://github.com/OpenBMB/ChatDev/commit/4fd4da603801766b14ad8788649cfc1ad21f99a6 ↗
- https://www.vulncheck.com/advisories/openbmb-chatdev-unauthenticated-path-traversal-in-upload-handler-allows-arbitrary-file-write-and-delete ↗