CVE-2026-28795Disclosure(zhongyu09 / openchatbi)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language conversations. Prior to version 0.2.2, the save_report tool in openchatbi/tool/save_report.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the file_format parameter. This issue has been patched in version 0.2.2.

zhongyu09 CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/zhongyu09/openchatbi/issues/10

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openchatbi

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 1d ago at 3 mentions (2026-03-06); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

zhongyu09

Products

openchatbi

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

General

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-06	3	Disclosure2General1
2026-03-11	1	General1

Full discourse4 posts

CRAC Learning - Tech@cracbot211d
General
CVE-2026-28795 (CVSS:8.7, CRITICAL) is Analyzed. OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze,..https://nvd.nist.gov/vuln/detail/CVE-2026-28795 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post highlights CVE-2026-28795 as a critical vulnerability with a CVSS score of 8.7, but offers no proof‑of‑concept, exploit tool, active exploitation evidence, patch information, or false positive claim.
0000024
172 followersView on X
Infoflowcloud@infoflowcloud216d
Disclosure
🚨*CVE* CVE-2026-28795 OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language c… https://www.cve.org/CVERecord?id=CVE-2026-28795 ----- Traducción: CVE-2026-28795 Ope… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-28795 for OpenChatBI, directing users to the CVE record, but offers no technical, exploit, or mitigation details.
0000026
56 followersView on X
CVE@CVEnew216d
General
CVE-2026-28795 OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language c… https://www.cve.org/CVERecord?id=CVE-2026-28795
Post summary
The provided text references CVE-2026-28795 for OpenChatBI but offers no further details, PoC, patch, or exploitation information.
00000138
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds216d
Disclosure
CVE-2026-28795 Path Traversal Vulnerability in OpenChatBI Save Report Tool Before Version 0.2.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28795
Post summary
The note reports a path traversal flaw in OpenChatBI Save Report Tool versions prior to 0.2.2, but offers no further technical, exploitation, or patch details.
0000044
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	zhongyu09	openchatbi	-	-	-

Explore more

Back to dashboard zhongyu09 CVEs openchatbi vulnerabilities

What researchers are saying

CVE-2026-28795

CRAC Learning - Tech@cracbotGeneral

The post highlights CVE-2026-28795 as a critical vulnerability with a CVSS score of 8.7, but offers no proof‑of‑concept, exploit tool, active exploitation evidence, patch information, or false positive claim.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE-2026-28795 for OpenChatBI, directing users to the CVE record, but offers no technical, exploit, or mitigation details.

CVE@CVEnewGeneral

The provided text references CVE-2026-28795 for OpenChatBI but offers no further details, PoC, patch, or exploitation information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The note reports a path traversal flaw in OpenChatBI Save Report Tool versions prior to 0.2.2, but offers no further technical, exploitation, or patch details.