OpenChatBI is an intelligent chat-based BI tool powered by large language models

CVE-2026-28795 is a path traversal flaw in OpenChatBI's save_report tool. In vulnerable builds <=0.2.1, the code strips only leading dots from the file_format parameter and then concatenates it into the output filename, so values like /../../... can escape the intended report directory and turn a report export into an arbitrary file write. The fix landed in 0.2.2, which replaced the weak sanitization with a strict allowlist of supported extensions.

The vendor-style 9.8 framing overstates real enterprise risk. The primitive is dangerous, but the exploitable population is much smaller than a generic pre-auth internet service: this is a niche self-hosted BI/LLM app, many deployments are internal, and turning arbitrary file write into full RCE usually needs a second condition such as write access to a Python import path, startup path, or another executable location. That keeps this in HIGH, not CRITICAL.

Why this verdict

• Start at 9.8, then cut for population. The vendor/NVD baseline assumes a generic unauthenticated network service, but OpenChatBI is a niche self-hosted package with a much smaller exposed install base than mainstream enterprise middleware.
• Cut again for attacker position. In many real deployments this requires access to an internal BI assistant or developer-run demo surface, which implies a narrower reachable population than edge-facing software.
• Keep it HIGH because the primitive is still ugly. Arbitrary file write from a remote prompt/tool path is serious, and where the service account can touch executable paths the impact can absolutely become RCE or persistence.

Why not higher?

There is no KEV entry, no credible in-the-wild exploitation evidence, and EPSS is low. More importantly, the chain from file write to full system compromise is conditional: writable execution paths, permissive filesystem rights, and sometimes a restart or import event are all real friction points that stop this from being a straight CRITICAL in most enterprises.

Why not lower?

This is still a remote arbitrary file write on the application host, not a cosmetic bug. Even if code execution does not materialize, unauthorized file creation or overwrite on an analytics server can damage integrity, create persistence, or poison downstream workflows, so MEDIUM would be too forgiving.

1. Constrain filesystem writes — Run the OpenChatBI service account with write access only to the intended report directory and deploy this within the noisgate mitigation SLA for a HIGH finding, meaning within 30 days. This is the single best compensating control because it converts a broad arbitrary file write into a contained report-write failure.
2. Make the application root read-only — If containerized, use a read-only root filesystem and mount only a narrow writable volume for report output; if not containerized, apply equivalent OS ACLs within 30 days. This directly breaks the most dangerous post-write step: overwriting importable code or startup paths.
3. Restrict reachability — Put OpenChatBI behind VPN, SSO, reverse-proxy auth, or IP allowlisting within 30 days if it is currently reachable from untrusted networks. The biggest severity reducer in practice is shrinking who can even reach the tool-calling surface.
4. Log and alert on tool arguments — Capture save_report invocations and alert on file_format values containing /, \, .., or unsupported extensions within 30 days. This gives you early delivery-stage visibility before the arbitrary write lands.
5. Enable FIM on code and startup paths — Deploy file integrity monitoring for the OpenChatBI package tree, startup folders, profiles, and report directories within 30 days. That will catch the step that matters operationally: unexpected writes outside the normal export path.

Run this on the target host, container, golden image, or CI job that builds the OpenChatBI environment. Invoke it with python3 verify_openchatbi_cve_2026_28795.py or point it at a source tree with python3 verify_openchatbi_cve_2026_28795.py /opt/openchatbi; no admin rights are required, but you need read access to the Python environment or source files.

#!/usr/bin/env python3
# verify_openchatbi_cve_2026_28795.py
# Detects whether OpenChatBI is vulnerable to CVE-2026-28795.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
from pathlib import Path

try:
    from importlib import metadata as importlib_metadata
except Exception:
    import importlib_metadata  # type: ignore


def parse_version(v):
    parts = re.findall(r"\d+", v or "")
    if not parts:
        return tuple()
    return tuple(int(x) for x in parts[:4])


def version_leq(a, b):
    la = list(a)
    lb = list(b)
    while len(la) < len(lb):
        la.append(0)
    while len(lb) < len(la):
        lb.append(0)
    return tuple(la) <= tuple(lb)


def inspect_file(path: Path):
    try:
        text = path.read_text(encoding="utf-8", errors="ignore")
    except Exception:
        return None

    has_lstrip = 'file_format.lstrip(".")' in text or "file_format.lstrip('.')" in text
    has_allowlist = "allowed_formats" in text and "Unsupported file format" in text

    if has_allowlist and not has_lstrip:
        return "PATCHED"
    if has_lstrip and not has_allowlist:
        return "VULNERABLE"
    if has_lstrip and has_allowlist:
        return "UNKNOWN"
    return None


def candidate_paths(root: Path):
    paths = [
        root / "openchatbi" / "tool" / "save_report.py",
        root / "tool" / "save_report.py",
        root / "save_report.py",
    ]
    return [p for p in paths if p.exists()]


def main():
    target = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else None

    # 1) Source tree inspection if a path argument is provided
    if target:
        if target.is_file():
            result = inspect_file(target)
            if result == "PATCHED":
                print("PATCHED")
                sys.exit(0)
            if result == "VULNERABLE":
                print("VULNERABLE")
                sys.exit(1)
        elif target.is_dir():
            for p in candidate_paths(target):
                result = inspect_file(p)
                if result == "PATCHED":
                    print("PATCHED")
                    sys.exit(0)
                if result == "VULNERABLE":
                    print("VULNERABLE")
                    sys.exit(1)

    # 2) Installed package version check
    try:
        version = importlib_metadata.version("openchatbi")
        pv = parse_version(version)
        if pv:
            if version_leq(pv, (0, 2, 1)):
                print("VULNERABLE")
                sys.exit(1)
            if pv >= (0, 2, 2):
                print("PATCHED")
                sys.exit(0)
    except Exception:
        pass

    # 3) Import path code inspection as fallback
    try:
        import openchatbi  # type: ignore
        pkg_root = Path(openchatbi.__file__).resolve().parent
        for p in candidate_paths(pkg_root.parent):
            result = inspect_file(p)
            if result == "PATCHED":
                print("PATCHED")
                sys.exit(0)
            if result == "VULNERABLE":
                print("VULNERABLE")
                sys.exit(1)
    except Exception:
        pass

    print("UNKNOWN")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. NVD CVE-2026-28795
2. GitHub Security Advisory GHSA-vmwq-8g8c-jm79
3. Fix commit 372a7e8
4. Public vulnerability report issue #10
5. Patch pull request #12
6. OpenChatBI repository README
7. PyPI openchatbi release history
8. FIRST EPSS API for CVE-2026-28795