CVE-2026-28795 is a critical (CVSS 9.8) path traversal in OpenChatBI, a chat-based BI tool, in versions before 0.2.2. The save_report tool does not sanitize its file_format parameter, so files can be written outside the report folder. The fix is 0.2.2.
What's affected
The GitHub advisory lists the PyPI package openchatbi at 0.2.1 and earlier. The patched version is 0.2.2, which includes the change from pull request 12. The advisory lists no workaround.
The flaw is in openchatbi/tool/save_report.py.
How to check if you're exposed
Check the installed version:
pip show openchatbi
In a requirements file or lockfile, search for the package name. Anything at 0.2.1 or lower needs the update.
What to do now
- Upgrade
openchatbito 0.2.2 or later. - Run the service as a user that can write only to the report directory, so a path mistake cannot reach code or system files.
- Treat tool parameters chosen by a language model as untrusted input, and validate them in the tool.
- Review the application directory for modified files if the tool was exposed.
- Add the package to automated dependency checks.
Why it matters
This is path traversal, CWE-22. The code strips leading dots from the file format but allows sequences that move up directories, and it builds the filename by string concatenation. The result can land outside the intended folder.
The advisory adds an AI-specific twist: an attacker can steer the language model into calling the tool with a chosen file format, and the example it gives is overwriting a package initialization file, which may lead to code execution. That means prompt content becomes an input to the file system.
Anything an agent tool accepts should be validated as strictly as a web form field. The record does not mark the CVE as exploited in the wild.
Quick check
Is this only a risk for public chatbots?
Any deployment where untrusted people can influence the model's prompts can be affected. Internal tools are exposed if users or documents can inject instructions.
Sources
Last reviewed: 19 October 2026.
