CVE-2026-28795

Critical

Published: 06 March 2026

Published

06 March 2026

Modified

10 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 24.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-28795 is a critical-severity Path Traversal (CWE-22) vulnerability in Zhongyu09 Openchatbi. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mandates validation and sanitization of inputs like the file_format parameter to block path traversal sequences such as '../'.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of flaws like the insufficient input sanitization in save_report.py, as demonstrated by the patch in version 0.2.2.

AC-3 Access Enforcement partial match

prevent

Enforces approved access authorizations for file system resources, limiting the scope of damage from successful path traversal by restricting writes to authorized directories.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1100 Web Shell Persistence

A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing web app (OpenChatBI) directly enables remote unauthenticated exploitation (T1190); arbitrary file read maps to data collection from local system (T1005); arbitrary file write facilitates web shell deployment for persistence/execution (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural language conversations. Prior to version 0.2.2, the save_report tool in openchatbi/tool/save_report.py suffers from a critical path traversal…

vulnerability due to insufficient input sanitization of the file_format parameter. This issue has been patched in version 0.2.2.

Deeper analysisAI

CVE-2026-28795 is a critical path traversal vulnerability (CWE-22) in OpenChatBI, an intelligent chat-based business intelligence tool powered by large language models for querying, analyzing, and visualizing data via natural language. The flaw affects versions prior to 0.2.2 and stems from insufficient input sanitization of the file_format parameter in the save_report tool at openchatbi/tool/save_report.py.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Exploitation allows high-impact effects on confidentiality, integrity, and availability, enabling attackers to traverse directory paths and potentially read or write arbitrary files on the affected system.

The issue has been addressed in OpenChatBI version 0.2.2. Mitigation details are available in the GitHub security advisory (https://github.com/zhongyu09/openchatbi/security/advisories/GHSA-vmwq-8g8c-jm79), the patching commit (https://github.com/zhongyu09/openchatbi/commit/372a7e861da5159c3106d64d6f6edf8284db8c75), the related issue tracker (https://github.com/zhongyu09/openchatbi/issues/10), and the pull request (https://github.com/zhongyu09/openchatbi/pull/12).

As an LLM-powered tool, OpenChatBI demonstrates the importance of robust input validation in AI-driven applications handling user-generated content for data operations. No public evidence of real-world exploitation is noted in the provided details.