{"data":{"id":"6008e238-5369-4e8d-aeda-2ca1aa178d91","title":"CVE-2026-28795: OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query…","summary":"CVE-2026-28795 is a path traversal flaw (CWE-22) in the save_report tool in openchatbi/tool/save_report.py of OpenChatBI, an LLM-powered chat BI tool. Prior to version 0.2.2, insufficient sanitization of the file_format parameter lets it traverse paths. GitHub, Inc. rated it CVSS 4.0 8.7 (HIGH) with network attack vector, low complexity, no privileges and no user interaction required, with high confidentiality impact.","solution":"This issue has been patched in version 0.2.2.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28795","publishedAt":"2026-03-06T07:16:00.293Z","cveId":"CVE-2026-28795","cweIds":["CWE-22"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openchatbi@<= 0.2.1 (fixed: 0.2.2)"],"affectedPackageNames":["openchatbi"],"affectedPackageRefs":["pypi:openchatbi"],"affectedVendors":[],"affectedVendorsRaw":["OpenChatBI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"OpenChatBI path traversal in save_report through file_format parameter","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00508,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-vmwq-8g8c-jm79"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:33.373Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-03-02T03:41:05.563Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:40:10.950Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"openchatbi","fixedVersion":"0.2.2","matchedVersion":"0.2.2","fixReleasedAt":"2026-03-02T03:41:05.563Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:10.803Z"}]}}